CWE-140 · weakness in Injection and Smuggling
Improper Neutralization of Delimiters
22 CVEs · 1 exploited
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 1
Every one of the 22 is a mark on the map. Named now: 1 to 22, most at risk first.
- The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with…
UnrealIRCd2 articles2 articles this week: CISA Confirms Active Exploitation of UnrealIRCd Command Injection Flaw
- Livestatus command injection in RestAPI
- Kirby vulnerable to field injection in the KirbyData text storage handler
- Livestatus injection in ajax_search
- Livestatus command injection in RestAPI
- Livestatus injection in availability timeline
- fish-shop/syntax-check Improper Neutralization of Delimiters
- Using malformed From header can forge identity with ";" or NULL in name portion
- Livestatus injection in mknotifyd
- Livestatus Injection in dynmaps
- Livestatus injection in autocomplete endpoint
- iccDEV has Type Confusion in CIccTag:IsTypeCompressed()
- OctoPrint Vulnerable to Denial of Service through malformed HTTP request
- Improper Neutralization of Delimiters in Mongoose Web Server library
- Potential livestatus injection in notification test
- mistral.rs before 0.9.5 Tool Call Injection via mistralrs-core Output Parsers
- Potential livestatus injection in prediction graph page
- Livestatus injection in monitoring quicksearch
- Junos OS and Junos OS Evolved: Annotate configuration command can be used to change the configuration
- Sssd: sssd: information disclosure via query injection in entra id lookups
- Improper Neutralization of Delimiters in Mongoose Web Server library
- Sssd: sssd: information disclosure via odata injection in entra id lookups
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.