CVE-2024-58362 | High | 8.8 | 2026-07-18 | SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively… |
CVE-2026-54771 | High | 8.1 | 2026-07-10 | Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.3, a Langroid application exposing a chat interface to un… |
CVE-2026-31908 | Critical | 9.1 | 2026-04-14 | Header injection vulnerability in Apache APISIX.
The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.
… |
CVE-2026-29042 | Critical | 9.8 | 2026-03-06 | Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command in… |
CVE-2026-27120 | Medium | 6.1 | 2026-02-20 | Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended g… |
CVE-2024-27708 | Critical | 9.6 | 2025-12-22 | Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src pa… |
CVE-2025-61911 | Medium | 6.5 | 2025-10-10 | python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_fi… |
CVE-2025-50213 | Critical | 9.8 | 2025-06-24 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.
This issue affect… |
CVE-2024-9940 | Medium | 5.3 | 2024-10-17 | The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to the plugin not pro… |
CVE-2024-37779 | High | 8.8 | 2024-09-23 | WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant script functionality. |
CVE-2024-39227 | Critical | 9.8 | 2024-08-06 | GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E75… |
CVE-2024-24257 | High | 7.5 | 2024-07-26 | An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain sensitive information via a crafted script… |
CVE-2024-39243 | Critical | 9.8 | 2024-06-26 | An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/admin/develop/editor_save. |
CVE-2024-35373 | Critical | 9.8 | 2024-05-24 | Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php. |
CVE-2024-31812 | Medium | 6.5 | 2024-04-08 | In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getWiFiExtenderConfig. |
CVE-2024-31809 | High | 8.8 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the FileName parameter in the setUpgradeFW func… |
CVE-2024-31806 | Medium | 6.5 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a Denial-of-Service (DoS) vulnerability in the RebootSystem function which can reboot the syste… |
CVE-2024-21503 | Medium | 5.3 | 2024-03-19 | Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in… |
CVE-2024-0801 | High | 7.5 | 2024-03-13 | A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll. |
CVE-2024-0044 | Medium | 6.7 | 2024-03-11 | In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalat… |
CVE-2024-23274 | High | 7.8 | 2024-03-08 | An injection issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app… |
CVE-2024-23268 | High | 7.8 | 2024-03-08 | An injection issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app… |
CVE-2024-27622 | High | 7.2 | 2024-03-05 | A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises… |
CVE-2023-40743 | Critical | 9.8 | 2023-09-05 | ** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFact… |
CVE-2023-1758 | Medium | 5.4 | 2023-04-05 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-27533 | High | 8.8 | 2023-03-30 | A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted use… |
CVE-2023-23912 | High | 8.8 | 2023-02-09 | A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with their DHCPv6 prefix… |
CVE-2023-0302 | High | 7.8 | 2023-01-15 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2. |
CVE-2022-48217 | High | 8.1 | 2023-01-04 | The tf_remapper_node component 1.1.1 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in the same ROS applica… |
CVE-2022-4721 | Medium | 5.4 | 2022-12-27 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2022-3607 | Medium | 6.0 | 2022-10-19 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3. |
CVE-2022-24039 | Critical | 9.0 | 2022-05-10 | A vulnerability has been identified in Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The “addCell” JavaSc… |
CVE-2021-39174 | High | 8.8 | 2021-08-28 | Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can leak the value of… |
CVE-2021-22910 | Critical | 9.8 | 2021-08-09 | A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could result in a NoSQL… |
CVE-2021-22911 | Critical | 9.8 | 2021-05-27 | A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potent… |
CVE-2016-9471 | Low | 3.1 | 2017-03-28 | Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver in… |