Improper Neutralization of Special Elements in Data Query Logic

Every one of the 139 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Jpom 2.10.0-2.11.12 - Authentication BypassCVE-2026-120201dromara · CVSS 9.8 · 2.1% likely

   Dromara

2. Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted c…CVE-2017-129046.4% likely
3. Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)CVE-2026-57193asterisk · CVSS 6.9 · 2.0% likely

   Asterisk

4. An Improper Neutralization of Special Elements in Query vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which allows an attacker t…CVE-2018-7829Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation… · 1.7% likely
5. cruddl vulnerable to AQL injection through flexSearchCVE-2022-36084AEB-labs · CVSS 9.9 · 1.5% likely
6. Cisco SD-WAN vManage Cypher Query Language Injection VulnerabilityCVE-2021-1349Cisco · CVSS 6.5 · 1.4% likely

   Cisco

7. Microsoft Discovery Studio Information Disclosure VulnerabilityCVE-2026-62906Microsoft · CVSS 7.4 · 0.9% likely

   Microsoft

8. Sort order SQL injection in AdministrateCVE-2020-5257thoughtbot · CVSS 7.7 · 0.9% likely
9. Cisco SD-WAN vManage Cypher Query Language Injection VulnerabilityCVE-2021-1481Cisco · CVSS 4.3 · 0.8% likely

   Cisco

10. Cisco SD-WAN vManage Software Cypher Query Language Injection VulnerabilityCVE-2021-34712Cisco · CVSS 5.4 · 0.7% likely

    Cisco

11. Parse Server: Account takeover via operator injection in authentication data identifierCVE-2026-32248parse-community · CVSS 9.3 · 0.7% likely

    Parse-Community

12. Table scope bypass vulnerability in custom reportsCVE-2026-10698Progress · CVSS 7.2 · 0.6% likely

    Progress Software

13. FastGPT: NoSQL Injection in loginByPassword leads to Authentication BypassCVE-2026-40351labring · CVSS 9.8 · 0.6% likely

    Labring

14. NoSQL Injection Leading to Authentication Bypass in your_spotifyCVE-2024-28192Yooooomi · CVSS 5.3 · 0.6% likely

    Yooooomi

15. An Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a malicious actor with authenticated access to the network to escalate privileges.CVE-2026-22558Ubiquiti Inc · CVSS 7.7 · 0.6% likelycovered by CyberSIXT

    Ubiquiti Inc

16. New API has an SQL LIKE Wildcard Injection DoS via Token SearchCVE-2026-25591QuantumNous · CVSS 7.1 · 0.6% likely

    QuantumNous

17. Mongoose: sanitizeFilter not applied on countDocumentsCVE-2026-125120Automattic · CVSS 9.8 · 0.6% likelycovered by CyberSIXT

    Automattic1 article1 article this week: Mongoose patches five flaws enabling injection and prototype pollution

18. IBM Db2 denial of serviceCVE-2024-35136IBM · CVSS 5.3 · 0.6% likely

    IBM

19. IBM Db2 denial of serviceCVE-2024-31882IBM · CVSS 5.3 · 0.6% likely

    IBM

20. Parameter injection in DB connection URIs leading to local file inclusion in WhoDBCVE-2025-24787clidey · CVSS 8.6 · 0.6% likely
21. Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injectio…CVE-2026-46591Apache Software Foundation · CVSS 8.2 · 0.5% likely

    Apache

22. Mongoose: Connection-level sanitizeFilter not appliedCVE-2026-125119Automattic · CVSS 7.5 · 0.5% likelycovered by CyberSIXT

    Automattic1 article1 article this week: Mongoose patches five flaws enabling injection and prototype pollution

23. Cisco Identity Search Engine SXP REST API SQL Injection VulnerabilityCVE-2026-20284Cisco · CVSS 9.1 · 0.5% likelycovered by CyberSIXT

    Cisco2 articles

24. NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guardCVE-2026-93760MongoDB Inc. · CVSS 8.2 · 0.5% likelycovered by CyberSIXT

    MongoDB1 article

25. LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposureCVE-2026-55253langchain-ai · CVSS 7.7 · 0.5% likely

    LangChain AI

26. High-Severity Vulnerability In Web Application Component of BeyondTrust Remote Support and Privileged Remote AccessCVE-2026-40141BeyondTrust · CVSS 8.5 · 0.5% likelycovered by CyberSIXT

    BeyondTrust

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.