CWE-172 · weakness in Injection and Smuggling
Improper Encoding or Decoding of Data
22 CVEs
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 22 is a mark on the map. Named now: 1 to 22, most at risk first.
- A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 throu…
- A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm to exit with an exc…
- An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames containing pure UTF-16 characters can bypass detection. The use…
- Cisco Adaptive Security Appliance Software SSL VPN Denial of Service Vulnerability
- service/jni/com_android_server_wifi_Gbk2Utf.cpp in the Qualcomm Wi-Fi gbk2utf module in Android before 2016-10-05 allows remote attackers to cause a denial of service (framework c…
- SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50)…
- A large loop in JBIG2Stream::readSymbolDictSeg in xpdf 4.00 allows an attacker to cause denial of service via a specific file due to inappropriate decoding.
- The ih264d decoder in mediaserver in Android 6.x before 2016-08-01 does not initialize certain structure members, which allows remote attackers to cause a denial of service (devic…
- decoder/ih264d_api.c in mediaserver in Android 6.x before 2016-08-01 mishandles invalid PPS and SPS NAL units, which allows remote attackers to cause a denial of service (device h…
- codecs/hevcdec/SoftHEVC.cpp in libstagefright in mediaserver in Android 6.0.1 before 2016-08-01 mishandles decoder errors, which allows remote attackers to cause a denial of servi…
- RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers
- Libmodsecurity3 has possible bypass of encoded HTML entities
- Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
- NGINX ngx_http_v3_module vulnerability
- NGINX ngx_http_proxy_v2_module vulnerability
- OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass
- SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not
- ModSecurity: HTML decoder missing entities, leading to evasion
- Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding error
- Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19
- fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
- fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.