CWE-790 · weakness in Injection and Smuggling
Improper Filtering of Special Elements
14 CVEs
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 14 is a mark on the map. Named now: 1 to 14, most at risk first.
- A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr,…
- Admin privilege escalation and arbitrary code execution via malicious *.etherpad imports
- An issue discovered in RG-RSR10-01G-T(W)-S and RG-RSR10-01G-T(WA)-S routers with firmware version RSR10-01G-T-S_RSR_3.0(1)B9P2, Release(07150910) allows attackers to execute arbit…
- Sequalize - Default support for “raw attributes” when using parentheses
- Dell RecoverPoint for Virtual Machines 6.0.x contains Denial of Service vulnerability. A User with Remote access could potentially exploit this vulnerability, leading to the disru…
- Potential wildcard CNAME RPZ policy bypass
- Enterprise Protection Backslash URL Rewrite Bypass
- Stored XSS in System Configuration
- Multiple issues in ctl(4) CAM Target Layer
- Information exlosure in external interface
- Stored XSS in process management
- Backend Access Due to Insufficient Input Validation
- Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths
- Ericsson Indoor Connect 8855 - Improper Filtering of Special Elements Vulnerability
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.