CWE-116

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted math

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0

Umbraco Forms is a form builder that integrates with the Umbraco content management system. Starting in the 7.x branch a

A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encou

The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.4 / Nagios XI 5.8.6 contains a reflected cross-site

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2

Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used

Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user int

A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions.

IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow an authenticated user to inject malicious inf

IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Confirm Account Extension

Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.

Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) all

SAP BusinessObjects Business Intelligence Platform lets an unauthenticated remote attacker send crafted requests through

Improper Encoding or Escaping of Output vulnerability in Ays Pro Poll Maker poll-maker.This issue affects Poll Maker: fr

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 could allow an attacker to spoof their IP address, which is written to log f

IBM OpenPages with Watson 8.3 and 9.0 may write improperly neutralized data to server log files when the tracing is enab

Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1

An Improper Encoding or Escaping of Output vulnerability in the Sampling Route Record Daemon (SRRD) of Juniper Networks

Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.

python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn

There is a Denial of Service（DoS）vulnerability in the ZTE MC889A Pro product. Due to insufficient validation of the inpu

IBM Security Guardium 12.0 could allow a privileged user to download any file on the system due to improper escaping of

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-

Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niaga

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escapi

Improper Encoding or Escaping of Output vulnerability in Logo Software Inc. Logo Cloud allows Phishing. This issue affe

Dell PowerProtect Data Manager Reporting, version(s) 19.17, 19.18 contain(s) an Improper Encoding or Escaping of Output

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value

In multiple locations, there is a possible way to access content across user profiles due to URI double encoding. This c

An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user i

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.4.6, 18.5 before 18.5.4, and 1

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integra

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may fa

During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded t

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows Web

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Version Compare Extension

A vulnerability exists in PX Backup whereby sensitive information may be logged under specific conditions.

A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the `SQLConverte

A security issue exists within DataMosaix™ Private Cloud allowing for Persistent XSS. This vulnerability can result in t

IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, cau

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or ma

Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts i

XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 13.10.5 and 14.3-rc

Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authen

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array

This package provides universal methods to use multiple template engines with the Fiber web framework using the Views in

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to fi

Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an