CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) (page 5)
Page 5 of 55 — CVEs classified under CWE-74, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-19894 | Medium | 6.3 | 2026-08-15 | A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewmedicine.php. Performing a… |
CVE-2026-19825 | High | 7.3 | 2026-08-14 | A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /clas… |
CVE-2026-19787 | Medium | 4.7 | 2026-08-14 | A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_cargo_… |
CVE-2026-19785 | Medium | 6.3 | 2026-08-14 | A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medica… |
CVE-2026-19767 | Medium | 6.3 | 2026-08-14 | A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. Ex… |
CVE-2026-19764 | High | 7.3 | 2026-08-14 | A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/us… |
CVE-2026-19747 | Critical | 9.8 | 2026-08-13 | A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAt… |
CVE-2026-19710 | High | 7.3 | 2026-08-13 | A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin… |
CVE-2026-12618 | High | 7.2 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-16747 | Medium | 6.5 | 2026-08-12 | The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shor… |
CVE-2026-48813 | | 2026-08-11 | Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue l… | |
CVE-2026-19384 | High | 7.3 | 2026-08-10 | A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php… |
CVE-2026-19364 | Medium | 6.3 | 2026-08-09 | A vulnerability was determined in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /viewdoctorconsultancych… |
CVE-2026-19355 | High | 7.3 | 2026-08-09 | A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of th… |
CVE-2026-19354 | Medium | 6.3 | 2026-08-09 | A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers… |
CVE-2026-19351 | High | 7.3 | 2026-08-09 | A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.b… |
CVE-2026-19348 | Critical | 9.8 | 2026-08-09 | A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt… |
CVE-2026-19347 | Medium | 6.3 | 2026-08-09 | A vulnerability was identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file /viewdoctor.php. Such man… |
CVE-2026-19346 | High | 8.8 | 2026-08-09 | A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulat… |
CVE-2026-19344 | High | 7.3 | 2026-08-09 | A vulnerability has been found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/comment_coun… |
CVE-2026-19343 | High | 7.3 | 2026-08-09 | A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php… |
CVE-2026-19334 | Medium | 5.3 | 2026-08-09 | A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9. This affects an unknown part of the file src/index.ts. This manip… |
CVE-2026-19333 | Medium | 5.3 | 2026-08-09 | A vulnerability was detected in NightTrek Supabase-MCP cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170/db03237d92f7dc2f0da0d70a87dba84ebcde5b66. Affected by this issu… |
CVE-2026-19332 | Medium | 5.3 | 2026-08-09 | A security vulnerability has been detected in NellyW8 MCP4EDA 1.0.0. Affected by this vulnerability is an unknown functionality of the component run_openlane/v… |
CVE-2026-19329 | Medium | 5.3 | 2026-08-09 | A vulnerability was found in andreahaku codex_mcp up to 1ff521cc6cc57cfe56ddef946c644b8534771390. The affected element is an unknown function of the file src/c… |
CVE-2026-19284 | Medium | 5.3 | 2026-08-08 | A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of… |
CVE-2026-19282 | Medium | 5.3 | 2026-08-08 | A weakness has been identified in andreahaku llm_memory_mcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. This impacts the function auto.capture of the file… |
CVE-2026-19281 | Medium | 5.3 | 2026-08-08 | A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAss… |
CVE-2026-19279 | Medium | 5.3 | 2026-08-08 | A vulnerability was identified in MIMICLab mcp-pdf-vision 1.1.0. The impacted element is the function load_pdf of the file src/index.ts. Such manipulation of t… |
CVE-2026-19268 | Medium | 6.3 | 2026-08-08 | A vulnerability was identified in abdullah1854 MCPGateway up to 549f494a9e363f40530149de324b8097de424230. This impacts the function getUsageByDateRange of the… |
CVE-2026-19266 | Medium | 5.5 | 2026-08-08 | A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the co… |
CVE-2026-19263 | High | 7.3 | 2026-08-08 | A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file… |
CVE-2026-48120 | High | 8.6 | 2026-08-07 | Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files lea… |
CVE-2026-19231 | High | 7.3 | 2026-08-07 | A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.ph… |
CVE-2026-19211 | High | 7.3 | 2026-08-07 | A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /social/ajax.php?action=signup. Performing a… |
CVE-2026-19196 | High | 7.3 | 2026-08-07 | A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The… |
CVE-2026-19071 | Medium | 6.3 | 2026-08-06 | A flaw has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewappointment.php. This manipulation of th… |
CVE-2026-19070 | Medium | 6.3 | 2026-08-06 | A vulnerability was detected in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewadmin.php. The manipulation of t… |
CVE-2026-19069 | Medium | 6.3 | 2026-08-06 | A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /treatmentrecord.php. T… |
CVE-2026-19068 | Medium | 6.3 | 2026-08-06 | A weakness has been identified in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /treatmentdetail.php. Ex… |
CVE-2026-19067 | Medium | 6.3 | 2026-08-06 | A security flaw has been discovered in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /treatment.php. Per… |
CVE-2026-19062 | High | 7.3 | 2026-08-06 | A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the file /paid/selectall.ac… |
CVE-2026-19060 | Medium | 5.3 | 2026-08-06 | A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2. This impacts an unknown function. Such manipulation leads to code injection. The attack… |
CVE-2026-19058 | Medium | 5.3 | 2026-08-06 | A vulnerability was found in FoundationAgents MetaGPT up to 0.8.2. The impacted element is the function DataInterpreter of the file metagpt/roles/di/data_inter… |
CVE-2026-15256 | Medium | 4.8 | 2026-08-06 | The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from bein… |
CVE-2026-68747 | Medium | 6.1 | 2026-08-06 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex… |
CVE-2026-19047 | Medium | 5.3 | 2026-08-06 | A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/… |
CVE-2026-19045 | Medium | 5.3 | 2026-08-06 | A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils… |
CVE-2026-19044 | Medium | 5.3 | 2026-08-06 | A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component… |
CVE-2026-19041 | Medium | 6.3 | 2026-08-06 | A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/co… |
CVE-2026-19039 | Medium | 5.3 | 2026-08-06 | A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function ssh_exec of the file sr… |
CVE-2026-19022 | Medium | 6.3 | 2026-08-06 | A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initialize_repo of the file OpenHands/resolver/send_pull_request… |
CVE-2026-19021 | High | 7.3 | 2026-08-06 | A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality o… |
CVE-2026-19020 | Medium | 6.3 | 2026-08-06 | A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /servicet… |
CVE-2026-18980 | Medium | 6.3 | 2026-08-06 | A vulnerability was identified in nearai ironclaw up to 0.29.1. Affected is the function classify_command_risk of the file src/tools/builtin/shell.rs. Such man… |
CVE-2026-18970 | High | 7.3 | 2026-08-06 | A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /d… |
CVE-2026-71320 | High | 8.1 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/… |
CVE-2026-18958 | High | 7.3 | 2026-08-05 | A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. Aff… |
CVE-2026-20272 | Critical | 9.8 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive inter… |
CVE-2026-18902 | High | 7.2 | 2026-08-05 | A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Per… |
CVE-2026-18896 | Medium | 6.3 | 2026-08-05 | A vulnerability was determined in lavkush-maurya Student-Registration-System 1.0. The affected element is an unknown function of the file /student/changepass.p… |
CVE-2026-18859 | High | 7.3 | 2026-08-05 | A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulati… |
CVE-2026-18854 | High | 7.3 | 2026-08-05 | A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter… |
CVE-2026-18814 | High | 7.2 | 2026-08-04 | A vulnerability was found in H3C NX15 V100R017. This impacts the function reload.reload_config of the file /api/esps. The manipulation results in command injec… |
CVE-2026-18813 | High | 7.2 | 2026-08-04 | A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file /api/esps. The manipulation of the argument esps.apcm.version… |
CVE-2026-18812 | High | 7.2 | 2026-08-04 | A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument… |
CVE-2026-18811 | High | 7.2 | 2026-08-04 | A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Performing a manipulation of the argument es… |
CVE-2026-18787 | High | 8.8 | 2026-08-04 | A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function remove_rule of the file /usr/share/gl-ngx/oui-rpc.lua of the… |
CVE-2026-18770 | High | 7.3 | 2026-08-04 | A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an unknown function of the file /code of the… |
CVE-2026-18766 | Medium | 6.3 | 2026-08-04 | A flaw has been found in chetans9 core-php-admin-panel up to 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f. This issue affects some unknown processing of the file /… |
CVE-2026-18719 | Medium | 6.3 | 2026-08-04 | A vulnerability was detected in cemtan sar2html 4.0.0. This affects an unknown part of the file sar2html.py of the component Search. Performing a manipulation… |
CVE-2026-18686 | Critical | 9.8 | 2026-08-04 | A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component… |
CVE-2026-18685 | Critical | 9.8 | 2026-08-04 | A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function set_upgrade of the file /cgi-bin/glc of the component mod… |
CVE-2026-18684 | Critical | 9.8 | 2026-08-03 | A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function remove_profile of the file /cgi-bin/glc of the component modem… |
CVE-2026-18616 | Critical | 9.8 | 2026-08-03 | A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component… |
CVE-2026-18615 | Critical | 9.8 | 2026-08-03 | A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of… |
CVE-2026-18614 | Critical | 9.8 | 2026-08-03 | A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Na… |
CVE-2026-18613 | Critical | 9.8 | 2026-08-03 | A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.set_config of the file /cgi-bin/glc of the component p… |
CVE-2026-18612 | Critical | 9.8 | 2026-08-03 | A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi… |
CVE-2026-18602 | Critical | 9.8 | 2026-08-03 | A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the comp… |
CVE-2026-69097 | High | 7.0 | 2026-08-03 | GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through mal… |
CVE-2026-18601 | Critical | 9.8 | 2026-08-03 | A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-c… |
CVE-2026-18600 | High | 8.8 | 2026-08-03 | A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-h… |
CVE-2026-18599 | High | 8.0 | 2026-08-03 | A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of t… |
CVE-2026-18598 | High | 8.8 | 2026-08-03 | A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/l… |
CVE-2026-18592 | Medium | 4.7 | 2026-08-03 | A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/Em… |
CVE-2026-55100 | | 2026-07-31 | hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values includin… | |
CVE-2026-15077 | Medium | 4.3 | 2026-07-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allo… |
CVE-2026-54680 | Critical | 9.9 | 2026-07-29 | Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in… |
CVE-2026-16729 | Medium | 4.8 | 2026-07-29 | undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9… |
CVE-2026-54666 | High | 8.3 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes Open… |
CVE-2026-54664 | High | 8.3 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts… |
CVE-2026-54662 | High | 8.3 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies s… |
CVE-2026-54661 | High | 8.3 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client… |
CVE-2026-18085 | Medium | 6.9 | 2026-07-28 | An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential De… |
CVE-2026-16765 | High | 7.3 | 2026-07-23 | A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkad… |
CVE-2026-16490 | Medium | 6.3 | 2026-07-22 | A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /prescription.php. The manipula… |
CVE-2026-16484 | High | 7.3 | 2026-07-21 | A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_sub… |
CVE-2026-16449 | Medium | 6.3 | 2026-07-21 | A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function OrderItem.asc/Order… |
CVE-2026-16448 | Medium | 6.3 | 2026-07-21 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |