CWE-138 · weakness in Injection and Smuggling
Improper Neutralization of Special Elements
15 CVEs
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 15 is a mark on the map. Named now: 1 to 15, most at risk first.
- Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability
- The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by inject…
- .NET Spoofing Vulnerability
- PAN-OS: Improper Neutralization Vulnerability Leads to Unintended Program Execution During Configuration Commit
- M365 Copilot Information Disclosure Vulnerability
- Ultimate SMS Notifications for WooCommerce <= 1.4.1 - CSV Injection
- Output of "go env" does not sanitize values in cmd/go
- Windows Kernel Elevation of Privilege Vulnerability
- Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message
- ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element
- Cisco Secure Firewall Adaptive Security Appliance SSH Partial Private Key Authentication Bypass Vulnerability
- OWASP CRS: XML Attribute Value Bypass
- Email HTML Injection
- Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to install a malicious app to potentially perfo…
- tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.