CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) (page 6)
Page 6 of 51 — CVEs classified under CWE-74, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8734 | High | 7.3 | 2026-05-17 | A vulnerability was determined in Oinone Pamirs up to 7.2.0. Affected by this issue is the function RSQLToSQLNodeConnector.makeVariable of the component queryL… |
CVE-2026-8724 | Medium | 4.7 | 2026-05-17 | A security flaw has been discovered in Dataease 2.10.20. Impacted is the function SqlparserUtils.transFilter of the file SqlparserUtils.java of the component D… |
CVE-2026-42334 | High | 7.5 | 2026-05-14 | Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows b… |
CVE-2026-44458 | Medium | 4.3 | 2026-05-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values… |
CVE-2026-44455 | Medium | 4.7 | 2026-05-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx… |
CVE-2026-44246 | High | 7.2 | 2026-05-12 | nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nnU-Net Issue Triage workflow in .github/… |
CVE-2026-42838 | Medium | 5.4 | 2026-05-12 | Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Edge (Chromium-based) allows an unauthorized at… |
CVE-2026-41109 | High | 8.8 | 2026-05-12 | Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized a… |
CVE-2026-33833 | High | 8.2 | 2026-05-12 | Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to… |
CVE-2026-8346 | Medium | 6.3 | 2026-05-12 | A vulnerability was detected in D-Link DIR-816 1.10CNB05_R1B011D88210. This affects the function portForward. Performing a manipulation of the argument ip_addr… |
CVE-2026-8345 | Medium | 6.3 | 2026-05-11 | A security vulnerability has been detected in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this issue is the function sub_445E7C of the file /goform/sing… |
CVE-2026-8344 | Medium | 6.3 | 2026-05-11 | A weakness has been identified in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this vulnerability is the function sub_445E7C of the file /goform/formDMZ… |
CVE-2025-8154 | Medium | 5.3 | 2026-05-11 | In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these he… |
CVE-2026-8231 | Medium | 6.3 | 2026-05-10 | A vulnerability has been found in CodeAstro Online Catering Ordering System 1.0. This affects an unknown function of the file /deleteorder.php. The manipulatio… |
CVE-2026-8211 | Medium | 4.7 | 2026-05-09 | A vulnerability was detected in codelibs Fess up to 15.5.1. Affected by this issue is the function update of the file org/codelibs/fess/app/web/admin/design/Ad… |
CVE-2026-8210 | Medium | 5.3 | 2026-05-09 | A security vulnerability has been detected in aandrew-me tgpt up to 2.11.1 on Linux/macOS. Affected by this vulnerability is the function helper.Update of the… |
CVE-2026-41885 | Medium | 6.5 | 2026-05-08 | i18next-locize-backend is a simple i18next backend for locize.com which can be used in Node.js, in the browser and for Deno. Prior to version 9.0.2, i18next-lo… |
CVE-2025-67486 | High | 7.2 | 2026-05-08 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenti… |
CVE-2026-8133 | High | 7.3 | 2026-05-08 | A security vulnerability has been detected in zyx0814 FilePress up to 2.2.0. Affected by this vulnerability is an unknown functionality of the file dzz/shares/… |
CVE-2026-8132 | High | 7.3 | 2026-05-08 | A weakness has been identified in CodeAstro Leave Management System 1.0. Affected is an unknown function of the file /login.php. This manipulation of the argum… |
CVE-2026-8131 | High | 7.3 | 2026-05-08 | A security flaw has been discovered in SourceCodester SUP Online Shopping 1.0. This impacts an unknown function of the file /admin/replymsg.php. The manipulati… |
CVE-2026-8130 | High | 7.3 | 2026-05-08 | A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. This affects an unknown function of the file /admin/message.php. The manipulation of… |
CVE-2026-8129 | High | 7.3 | 2026-05-08 | A vulnerability was determined in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file wishlist.php. Executing a man… |
CVE-2026-8128 | High | 7.3 | 2026-05-08 | A vulnerability was found in SourceCodester SUP Online Shopping 1.0. The affected element is an unknown function of the file /admin/viewmsg.php. Performing a m… |
CVE-2026-8126 | High | 7.3 | 2026-05-08 | A flaw has been found in SourceCodester Comment System 1.0. This issue affects some unknown processing of the file post_comment.php. This manipulation of the a… |
CVE-2026-8125 | Medium | 6.3 | 2026-05-08 | A vulnerability was detected in code-projects Simple Chat System 1.0. This vulnerability affects unknown code of the file sendMessage.php. The manipulation of… |
CVE-2026-8114 | Medium | 6.3 | 2026-05-07 | A vulnerability was identified in JeecgBoot up to 3.9.1. Affected by this issue is some unknown functionality of the file /sys/dict/loadTreeData of the compone… |
CVE-2026-26164 | High | 7.5 | 2026-05-07 | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information ove… |
CVE-2026-8098 | High | 7.3 | 2026-05-07 | A security vulnerability has been detected in code-projects Feedback System 1.0. Impacted is an unknown function of the file /admin/checklogin.php. Such manipu… |
CVE-2026-8097 | Medium | 6.3 | 2026-05-07 | A security flaw has been discovered in CodeAstro Online Classroom 1.0. This vulnerability affects unknown code of the file /askquery.php. The manipulation of t… |
CVE-2026-41691 | Medium | 6.5 | 2026-05-07 | Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without… |
CVE-2026-8083 | High | 7.3 | 2026-05-07 | A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /ajax.php?action=save_user. The m… |
CVE-2026-7833 | High | 7.2 | 2026-05-05 | A weakness has been identified in EFM ipTIME C200 up to 1.092. This vulnerability affects the function sub_408F90 of the file /cgi/iux_set.cgi of the component… |
CVE-2026-7822 | Medium | 6.3 | 2026-05-05 | A vulnerability was identified in itsourcecode Courier Management System 1.0. This impacts an unknown function of the file /print_pdets.php. The manipulation o… |
CVE-2026-7812 | High | 7.3 | 2026-05-05 | A vulnerability was found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8. The impacted element is the function git_operation of the file src… |
CVE-2026-7783 | Medium | 6.3 | 2026-05-05 | A flaw has been found in CodeCanyon Perfex CRM up to 3.4.1. This vulnerability affects the function AbstractKanban::applySortQuery of the file application/serv… |
CVE-2026-7746 | Medium | 6.3 | 2026-05-04 | A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected is an unknown function of the file /product_expiry/… |
CVE-2026-7745 | Medium | 6.3 | 2026-05-04 | A vulnerability was determined in CodeAstro Online Classroom 1.0. This impacts an unknown function of the file /OnlineClassroom/facultydetails. This manipulati… |
CVE-2026-7744 | Medium | 6.3 | 2026-05-04 | A vulnerability was found in CodeAstro Online Classroom 1.0. This affects an unknown function of the file /OnlineClassroom/addnewstudent. The manipulation of t… |
CVE-2026-7743 | Medium | 6.3 | 2026-05-04 | A vulnerability has been found in CodeAstro Online Classroom 1.0. The impacted element is an unknown function of the file /OnlineClassroom/studentdetails. The… |
CVE-2026-7742 | Medium | 6.3 | 2026-05-04 | A flaw has been found in CodeAstro Online Classroom 1.0. The affected element is an unknown function of the file /OnlineClassroom/facultylogin. Executing a man… |
CVE-2026-7741 | Medium | 6.3 | 2026-05-04 | A vulnerability was detected in CodeAstro Online Classroom 1.0. Impacted is an unknown function of the file /OnlineClassroom/studentlogin. Performing a manipul… |
CVE-2026-7731 | Medium | 6.3 | 2026-05-04 | A security vulnerability has been detected in code-projects BloodBank Managing System 1.0. The affected element is an unknown function of the file get_state.ph… |
CVE-2026-7727 | High | 7.3 | 2026-05-04 | A vulnerability was determined in Shandong Hoteam Software PDM Product Data Management System up to 8.3.9. This affects the function GetQueryMachineGridOnePage… |
CVE-2026-7725 | Medium | 6.3 | 2026-05-04 | A vulnerability was found in PrefectHQ prefect up to 3.6.25.dev6. Affected by this issue is some unknown functionality of the file src/prefect/runner/storage.p… |
CVE-2026-7721 | Medium | 6.3 | 2026-05-04 | A security vulnerability has been detected in Totolink WA300 5.2cu.7112_B20190227. This affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-7720 | Medium | 6.3 | 2026-05-04 | A weakness has been identified in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-7718 | Medium | 6.3 | 2026-05-04 | A vulnerability was identified in Totolink WA300 5.2cu.7112_B20190227. Impacted is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component… |
CVE-2026-7716 | Medium | 6.3 | 2026-05-04 | A vulnerability was found in code-projects Gym Management System In PHP and Windows NT 1.0. This vulnerability affects unknown code of the file /index.php. Per… |
CVE-2026-7705 | Medium | 6.3 | 2026-05-03 | A flaw has been found in JD Cloud JDCOS 4.5.1.r4518. This vulnerability affects the function set_iptv_info of the file /jdcap of the component Service Interfac… |
CVE-2026-7703 | High | 7.3 | 2026-05-03 | A flaw has been found in AV Stumpfl Pixera Two Media Server up to 25.2 R2. Impacted is an unknown function of the component Websocket API. This manipulation ca… |
CVE-2026-7700 | Medium | 6.3 | 2026-05-03 | A weakness has been identified in langflow-ai langflow up to 1.8.4. This affects the function eval of the file src/lfx/src/lfx/components/llm_operations/lambda… |
CVE-2026-7699 | Medium | 6.3 | 2026-05-03 | A security flaw has been discovered in Dromara MaxKey up to 3.5.13. Affected by this issue is the function StrUtils.checkSqlInjection of the file StrUtils.java… |
CVE-2026-7697 | Medium | 4.7 | 2026-05-03 | A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected is an unknown function of the file /manager/card/cardhand_submit.php. Thi… |
CVE-2026-7695 | High | 7.3 | 2026-05-03 | A vulnerability has been found in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. This affects an unknown function of th… |
CVE-2026-7694 | High | 7.3 | 2026-05-03 | A flaw has been found in Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System 1.3.0. The impacted element is an unknown function of… |
CVE-2026-7692 | Medium | 6.3 | 2026-05-03 | A vulnerability was detected in Wavlink WL-WN570HA1 R70HA1 V1410_221110. The affected element is the function ping_ddns of the file /cgi-bin/adm.cgi. Performin… |
CVE-2026-7691 | Medium | 6.3 | 2026-05-03 | A security vulnerability has been detected in Wavlink WL-WN570HA1 R70HA1 V1410_221110. Impacted is the function set_sys_cmd of the file /cgi-bin/adm.cgi. Such… |
CVE-2026-7690 | Medium | 6.3 | 2026-05-03 | A weakness has been identified in Wavlink WL-WN570HA1 R70HA1 V1410_221110. This issue affects the function set_sys_adm of the file /cgi-bin/adm.cgi. This manip… |
CVE-2026-7688 | Medium | 5.0 | 2026-05-03 | A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. This affects the function _checkValForAPI of the file htdocs/expedition/class/expedition.class… |
CVE-2026-7687 | Medium | 6.3 | 2026-05-03 | A vulnerability was determined in langflow-ai langflow up to 1.8.4. Affected by this issue is the function CodeParser.parse_callable_details of the file src/lf… |
CVE-2026-7683 | Medium | 6.3 | 2026-05-03 | A weakness has been identified in Edimax BR-6428nC up to 1.16. This affects an unknown function of the file /goform/setWAN of the component Web Interface. This… |
CVE-2026-7682 | Medium | 6.3 | 2026-05-03 | A security flaw has been discovered in Edimax BR-6208AC 1.02. The impacted element is the function setWAN of the file /goform/setWAN of the component L2TP Mode… |
CVE-2026-7678 | Medium | 6.3 | 2026-05-03 | A vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io… |
CVE-2026-7672 | Medium | 6.3 | 2026-05-03 | A security vulnerability has been detected in youlaitech youlai-boot up to 2.21.1. This affects the function getUserList of the file src/main/java/com/youlai/b… |
CVE-2026-7670 | High | 7.3 | 2026-05-02 | A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/UserSel.aspx. This manipulation of… |
CVE-2026-7669 | Medium | 5.6 | 2026-05-02 | A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_util… |
CVE-2026-7632 | High | 7.3 | 2026-05-02 | A vulnerability was determined in code-projects Online Hospital Management System 1.0. This affects an unknown function of the file /viewappointment.php. This… |
CVE-2026-7629 | Medium | 6.3 | 2026-05-02 | A flaw has been found in kleneway awesome-cursor-mpc-server up to 2.0.1. Impacted is the function runCodeReviewTool of the file src/tools/codeReview.ts of the… |
CVE-2026-7628 | Medium | 6.3 | 2026-05-02 | A vulnerability was detected in crazyrabbitLTC mcp-code-review-server up to 0.1.0. This issue affects the function executeRepomix of the file src/repomix.ts of… |
CVE-2026-7612 | Medium | 4.7 | 2026-05-02 | A vulnerability was determined in itsourcecode Courier Management System 1.0. Affected is an unknown function of the file /edit_user.php. Executing a manipulat… |
CVE-2026-7595 | Medium | 6.3 | 2026-05-01 | A flaw has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this vulnerability is the function _format_plugins of the file .claude/s… |
CVE-2026-7592 | High | 7.3 | 2026-05-01 | A weakness has been identified in itsourcecode Courier Management System 1.0. This affects an unknown function of the file /edit_staff.php. Executing a manipul… |
CVE-2026-7591 | Medium | 6.3 | 2026-05-01 | A security flaw has been discovered in TimBroddin astro-mcp-server up to 1.1.1. The impacted element is an unknown function of the file src/index.ts of the com… |
CVE-2026-7580 | Medium | 5.3 | 2026-05-01 | A vulnerability was detected in Exiftool up to 13.53. Impacted is the function Process_mrld of the file lib/Image/ExifTool/GM.pm of the component JPEG/QuickTim… |
CVE-2026-7555 | High | 7.3 | 2026-05-01 | A vulnerability was identified in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /intrams/login.php. Such manipulation of… |
CVE-2026-7553 | Medium | 4.7 | 2026-05-01 | A vulnerability was found in code-projects Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edit_exerci… |
CVE-2026-7550 | High | 7.3 | 2026-05-01 | A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.php?action=save_cus… |
CVE-2026-7549 | High | 7.3 | 2026-05-01 | A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=delete_customer… |
CVE-2026-7548 | High | 8.8 | 2026-05-01 | A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file /cgi-bin/cstecgi.cgi. Performing a man… |
CVE-2026-7545 | High | 7.3 | 2026-05-01 | A weakness has been identified in SourceCodester Advanced School Management System 1.0. The affected element is an unknown function of the file commonControlle… |
CVE-2026-7508 | Medium | 6.3 | 2026-04-30 | A vulnerability was found in Bootstrap CMS 0.9.0-alpha. Affected is an unknown function of the file resources/views/pages/show.blade.php of the component Page… |
CVE-2026-7506 | High | 7.3 | 2026-04-30 | A vulnerability has been found in SourceCodester Hotel Management System 1.0. This impacts an unknown function of the file /index.php/reservation/check. Such m… |
CVE-2026-7469 | Medium | 6.3 | 2026-04-30 | A vulnerability was detected in Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01. This impacts the function sub_425A28 of the file /goform/DelFil. The manipulation… |
CVE-2026-7447 | Medium | 6.3 | 2026-04-30 | A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/update_customer.php. T… |
CVE-2026-7410 | Medium | 6.3 | 2026-04-29 | A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=add_t… |
CVE-2026-7409 | Medium | 4.7 | 2026-04-29 | A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_user of the file /admin/ajax.php?action=save_user. Executi… |
CVE-2026-7408 | Medium | 4.7 | 2026-04-29 | A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function save_menu of the file /admin/ajax.php?actio… |
CVE-2026-7407 | Medium | 4.7 | 2026-04-29 | A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is the function save_settings of the… |
CVE-2026-7394 | Medium | 4.7 | 2026-04-29 | A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/vi… |
CVE-2026-7392 | Medium | 6.3 | 2026-04-29 | A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function delete_supplier of the file /ajax.php?actio… |
CVE-2026-7391 | Medium | 6.3 | 2026-04-29 | A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function save_supplier of the file /ajax.php?action=save_supp… |
CVE-2026-7389 | High | 7.3 | 2026-04-29 | A security vulnerability has been detected in EyouCMS up to 1.7.9. The affected element is the function GetSortData of the file application/common.php. The man… |
CVE-2026-7388 | Medium | 4.7 | 2026-04-29 | A weakness has been identified in EyouCMS up to 1.7.9. Impacted is the function editFile of the file application/admin/logic/FilemanagerLogic.php of the compon… |
CVE-2026-7316 | High | 7.3 | 2026-04-28 | A vulnerability has been found in eiliyaabedini aider-mcp up to 667b914301aada695aab0e46d1fb3a7d5e32c8af. Affected is an unknown function of the file aider_mcp… |
CVE-2026-7293 | Medium | 4.7 | 2026-04-28 | A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected is the function delete_category of the file /admin/ajax.php?action=delete… |
CVE-2026-7290 | Medium | 6.3 | 2026-04-28 | A vulnerability was determined in JeecgBoot up to 3.9.1. Impacted is the function SqlInjectionUtil of the file jeecg-boot/jeecg-boot-base-core/src/main/java/or… |
CVE-2026-7283 | Medium | 4.7 | 2026-04-28 | A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function save_expired of the file /ajax.php?act… |
CVE-2026-7282 | Medium | 4.7 | 2026-04-28 | A vulnerability was identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function delete_expired of the file /ajax.php?action… |
CVE-2026-7268 | Medium | 6.3 | 2026-04-28 | A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This impacts the function save_category of the file /admin/ajax.php?action=save_… |