CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) (page 2)
Page 2 of 51 — CVEs classified under CWE-74, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18614 | Critical | 9.8 | 2026-08-03 | A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Na… |
CVE-2026-18613 | Critical | 9.8 | 2026-08-03 | A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.set_config of the file /cgi-bin/glc of the component p… |
CVE-2026-18612 | Critical | 9.8 | 2026-08-03 | A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi… |
CVE-2026-18602 | Critical | 9.8 | 2026-08-03 | A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the comp… |
CVE-2026-69097 | High | 7.0 | 2026-08-03 | GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through mal… |
CVE-2026-18601 | Critical | 9.8 | 2026-08-03 | A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-c… |
CVE-2026-18600 | High | 8.8 | 2026-08-03 | A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-h… |
CVE-2026-18599 | High | 8.0 | 2026-08-03 | A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of t… |
CVE-2026-18598 | High | 8.8 | 2026-08-03 | A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/l… |
CVE-2026-18592 | Medium | 4.7 | 2026-08-03 | A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/Em… |
CVE-2026-55100 | | 2026-07-31 | hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values includin… | |
CVE-2026-15077 | Medium | 4.3 | 2026-07-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allo… |
CVE-2026-54680 | Critical | 9.9 | 2026-07-29 | Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in… |
CVE-2026-16729 | Medium | 4.8 | 2026-07-29 | undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9… |
CVE-2026-54666 | High | 8.3 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes Open… |
CVE-2026-54664 | High | 8.3 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts… |
CVE-2026-54662 | High | 8.3 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies s… |
CVE-2026-54661 | High | 8.3 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client… |
CVE-2026-18085 | Medium | 6.9 | 2026-07-28 | An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential De… |
CVE-2026-16765 | High | 7.3 | 2026-07-23 | A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkad… |
CVE-2026-16490 | Medium | 6.3 | 2026-07-22 | A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /prescription.php. The manipula… |
CVE-2026-16484 | High | 7.3 | 2026-07-21 | A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_sub… |
CVE-2026-16449 | Medium | 6.3 | 2026-07-21 | A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function OrderItem.asc/Order… |
CVE-2026-16448 | Medium | 6.3 | 2026-07-21 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2026-16334 | Medium | 6.3 | 2026-07-21 | A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability affects unknown code of the file /prescriptionorder.php. Such… |
CVE-2026-16252 | High | 7.3 | 2026-07-20 | A security flaw has been discovered in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System 8.2.2. Impacted is an unknown function… |
CVE-2026-16244 | Medium | 6.3 | 2026-07-20 | A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2026-16228 | High | 7.3 | 2026-07-19 | A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_schoolyr.php. Performin… |
CVE-2026-16227 | High | 7.3 | 2026-07-19 | A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /edit_subject… |
CVE-2026-16204 | Medium | 6.3 | 2026-07-19 | A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This affects the function tool_run_script_execute of the file claw/services/tools/script.c o… |
CVE-2026-16154 | High | 7.3 | 2026-07-18 | A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerability is an unknown functionality of the… |
CVE-2026-16152 | High | 7.3 | 2026-07-18 | A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_rooma.php. Performing a ma… |
CVE-2026-16133 | Medium | 5.0 | 2026-07-18 | A flaw has been found in LiuMengxuan04 MiniCode 0.1.0. Affected by this vulnerability is the function child_process.spawn of the file mcp.ts. Executing a manip… |
CVE-2026-16131 | Medium | 6.3 | 2026-07-18 | A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /prescriptionrecord.php. This manip… |
CVE-2026-54159 | Critical | 10.0 | 2026-07-17 | PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the ps_facetedsearch module rebuilds selected search filt… |
CVE-2026-16014 | High | 7.3 | 2026-07-17 | A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulat… |
CVE-2026-16009 | Medium | 6.3 | 2026-07-17 | A vulnerability was detected in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /prescriptionorderdetail.php. The mani… |
CVE-2026-44182 | Critical | 10.0 | 2026-07-16 | Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions pr… |
CVE-2026-54728 | | 2026-07-16 | bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). Prior to BunkerWeb 1.6.12 and BunkerWeb PRO 0.57, authenticated Host header han… | |
CVE-2026-15907 | High | 7.3 | 2026-07-16 | A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function of the file /webui/?g=log_fw_nbc_mail_jsondata. Executing a m… |
CVE-2026-15703 | High | 7.3 | 2026-07-14 | A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproduct… |
CVE-2026-15676 | High | 7.3 | 2026-07-14 | A security flaw has been discovered in code-projects Online Job Portal up to 1.0. The impacted element is an unknown function of the file /Admin/DeleteUser.php… |
CVE-2026-15675 | High | 7.3 | 2026-07-14 | A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file /Admin/EditUser.php. Such manipu… |
CVE-2026-15672 | Medium | 6.3 | 2026-07-14 | A vulnerability was determined in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the file /intrams/admin/add_judges.php. This m… |
CVE-2026-15597 | High | 7.3 | 2026-07-13 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/2.php. This affects an unknown function of the file /edit_exam2.php… |
CVE-2026-15559 | Medium | 6.3 | 2026-07-13 | A vulnerability was detected in CodeAstro Simple Online Leave Management System 1.0. This affects an unknown part of the file /SimpleOnlineLeave/admin/accept.p… |
CVE-2026-15558 | Medium | 6.3 | 2026-07-13 | A security vulnerability has been detected in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the… |
CVE-2026-15537 | High | 7.3 | 2026-07-13 | A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file admin/login.php. The ma… |
CVE-2026-15536 | Medium | 6.3 | 2026-07-13 | A vulnerability was identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /patviewprescription.php. The manipulat… |
CVE-2026-15533 | Medium | 4.7 | 2026-07-13 | A security flaw has been discovered in DedeCMS 5.7.118. Impacted is an unknown function of the file /plus/search.php of the component Column Management. Perfor… |
CVE-2026-15523 | Medium | 6.3 | 2026-07-13 | A weakness has been identified in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /Simple… |
CVE-2026-15517 | High | 7.3 | 2026-07-13 | A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx. This manipulatio… |
CVE-2026-15514 | High | 7.3 | 2026-07-13 | A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This vulnerability affects the function RPCService.query of the file /customizemt/x… |
CVE-2026-15512 | Medium | 6.3 | 2026-07-13 | A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the file \pig-master\pig-visual\pig-codegen… |
CVE-2026-15502 | Medium | 6.3 | 2026-07-12 | A vulnerability was detected in AojiaoZero Antaris 1.0. This affects the function _rewardPurchase of the file /ipn.php of the component PayPal IPN Payment Hand… |
CVE-2026-15498 | High | 7.3 | 2026-07-12 | A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa45ce12c. This impacts an unknown function of the file users… |
CVE-2026-15497 | High | 7.3 | 2026-07-12 | A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7.2. This affects an unknown function of the file sonic-server-controller/src/main/java/org… |
CVE-2026-15494 | Medium | 4.7 | 2026-07-12 | A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switch_status.php. Executing a… |
CVE-2026-15490 | High | 7.3 | 2026-07-12 | A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this issue is some unknown function… |
CVE-2026-15489 | High | 7.3 | 2026-07-12 | A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this vulnerability is an unknown functio… |
CVE-2026-15482 | High | 7.3 | 2026-07-12 | A weakness has been identified in Aster Telecom Azcall 10/11. This issue affects some unknown processing of the file /azcall/adm/gestao_loja/sis.php?t=consulta… |
CVE-2026-15481 | High | 8.8 | 2026-07-12 | A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function ipoa_test of the file /sbin/rc of the compone… |
CVE-2026-15478 | Medium | 6.3 | 2026-07-12 | A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the co… |
CVE-2026-15477 | Medium | 6.3 | 2026-07-12 | A vulnerability was detected in Bahmni bahmnicore up to 0.93. This affects the function additionalParams of the file /openmrs/ws/rest/v1/bahmnicore/sql of the… |
CVE-2026-58493 | | 2026-07-10 | grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call builds PDO DSN strings by directly concatenating user-configurable Y… | |
CVE-2026-55615 | | 2026-07-10 | Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.5, Neo4jChatAgent passes LLM-generated Cypher queries str… | |
CVE-2026-0284 | Critical | 9.9 | 2026-07-09 | An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with net… |
CVE-2026-15190 | High | 7.3 | 2026-07-09 | A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This affects an unknown part of the file /login.php. Performing a mani… |
CVE-2026-15137 | High | 7.3 | 2026-07-09 | A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code of the file \inc\classes\View.php. Thi… |
CVE-2026-15135 | High | 7.3 | 2026-07-09 | A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an unknown part of the file /edit_food_items.php. The manipulat… |
CVE-2026-15134 | High | 7.3 | 2026-07-09 | A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /… |
CVE-2026-58213 | High | 7.1 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include prot… |
CVE-2026-55404 | High | 7.5 | 2026-07-08 | yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can wri… |
CVE-2026-15035 | Medium | 5.3 | 2026-07-08 | A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repos… |
CVE-2026-55427 | High | 8.3 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder config-ssh`… |
CVE-2026-49099 | Medium | 5.3 | 2026-07-06 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerabil… |
CVE-2026-49098 | Medium | 5.3 | 2026-07-06 | Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Kaf… |
CVE-2026-49097 | Medium | 6.5 | 2026-07-06 | Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel IRC… |
CVE-2026-48203 | Critical | 9.1 | 2026-07-06 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSR… |
CVE-2026-14799 | Medium | 6.3 | 2026-07-06 | A security flaw has been discovered in CodeAstro Ecommerce Website 1.0. Impacted is an unknown function of the file /customer/my_account.php?my_wishlist. The m… |
CVE-2026-14798 | Medium | 6.3 | 2026-07-06 | A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. This issue affects some unknown processing of the file /apartment-visitor/… |
CVE-2026-14797 | Medium | 6.3 | 2026-07-06 | A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. This vulnerability affects unknown code of the file /apartment-visitor/edi… |
CVE-2026-14796 | Medium | 6.3 | 2026-07-06 | A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. This affects an unknown part of the file /apartment-visitor/report.php. Perform… |
CVE-2026-14795 | Medium | 6.3 | 2026-07-06 | A vulnerability has been found in CodeAstro Apartment Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /apartmen… |
CVE-2026-14774 | Medium | 6.3 | 2026-07-05 | A vulnerability was determined in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /paymentdischarge.php. This manipul… |
CVE-2026-14773 | Medium | 6.3 | 2026-07-05 | A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /payment.php. The manipulation of the ar… |
CVE-2026-14772 | High | 7.3 | 2026-07-05 | A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The impacted element is an unknown function of the file /edit_cou… |
CVE-2026-14771 | High | 7.3 | 2026-07-05 | A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The affected element is an unknown function of the file /edit_exam1.php. E… |
CVE-2026-14770 | High | 7.3 | 2026-07-05 | A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /edit_room.php. Performing a… |
CVE-2026-14769 | High | 7.3 | 2026-07-05 | A security vulnerability has been detected in code-projects Real State Services 1.0. This issue affects some unknown processing of the file /pay.php. Such mani… |
CVE-2026-14768 | High | 7.3 | 2026-07-05 | A weakness has been identified in code-projects Real State Services 1.0. This vulnerability affects unknown code of the file /builderHome.php. This manipulatio… |
CVE-2026-14767 | Medium | 6.3 | 2026-07-05 | A security flaw has been discovered in CodeAstro Ecommerce Website 1.0. This affects an unknown part of the file /ecommerce-website-php/customer/confirm.php of… |
CVE-2026-14766 | Medium | 6.3 | 2026-07-05 | A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /apartmen… |
CVE-2026-14764 | High | 7.3 | 2026-07-05 | A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0. This impacts an unknown function of the file /admin/add_event.php of the com… |
CVE-2026-14763 | High | 7.3 | 2026-07-05 | A flaw has been found in code-projects Hotel and Tourism Reservation 1.0. This affects an unknown function of the file /admin/tour_reserves.php of the componen… |
CVE-2026-14762 | High | 7.3 | 2026-07-05 | A vulnerability was detected in code-projects Hotel and Tourism Reservation 1.0. The impacted element is an unknown function of the file /admin/rooms.php of th… |
CVE-2026-14756 | High | 7.3 | 2026-07-05 | A vulnerability was found in code-projects Hotel and Tourism Reservation 1.0. Affected by this issue is some unknown functionality of the file /admin/add_tour… |
CVE-2026-14755 | High | 7.3 | 2026-07-05 | A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0. Affected by this vulnerability is an unknown functionality of the file /admi… |
CVE-2026-14754 | High | 7.3 | 2026-07-05 | A flaw has been found in code-projects Hotel and Tourism Reservation 1.0. Affected is an unknown function of the file /admin/add_room.php. Executing a manipula… |
CVE-2026-14751 | Medium | 6.3 | 2026-07-05 | A weakness has been identified in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. The impacted element is the function Notes_controller::se… |