CWE-176 · weakness in Injection and Smuggling
Improper Handling of Unicode Encoding
39 CVEs · 1 exploited
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 1
Every one of the 39 is a mark on the map. Named now: 1 to 26, most at risk first.
- In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicod…
- A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname…
- Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation
- Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticated user to enable an escalation of privi…
- Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch
- FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files
- Late-Unicode normalization vulnerability in SHIRASAGI
- Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
- Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication.
- SQLite sqldiff remote code execution via argument injection
- setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
- ewen-lbh/ffcss late-Unicode normalization vulnerability
- MOVEit Transfer Email MFA Bypass
- Ciphertext integrity weakness in Tink
- FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)
- Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have heap overflow when processing some malformed UTF-8 characters
- Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication.
- Improper Handling of Unicode Encoding
- Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp
- Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate
- uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars
- Fireware OS Improper Authorization in Access Portal Reverse Proxy
- protobufjs: Overlong UTF-8 decoding
- HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonation attacks after the fix for CVE-2025-52…
- node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS
- Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side performance degradation during processing of multiple Unicode combining characters, aka a…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.