CWE-140 · Injection and Smuggling
Improper Neutralization of Delimiters
21CVEs
SortMost likely exploited
21 CVEs with CWE-140 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-114713In CISA KEVExploitedThe labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with…UnrealIRCd · UnrealIRCd · CVSS 8.6 · 2026-11-08 | 8.6 | 0.3% | 2026-11-08 |
| CVE-2023-31208Livestatus command injection in RestAPICheckmk GmbH · Checkmk · CVSS 8.3 · 2023-05-17 | 8.3 | 1.0% | 2023-05-17 |
| CVE-2023-38488Kirby vulnerable to field injection in the KirbyData text storage handlergetkirby · kirby · CVSS 7.1 · 2023-07-27 | 7.1 | 0.9% | 2023-07-27 |
| CVE-2023-6157Livestatus injection in ajax_searchCheckmk GmbH · Checkmk · CVSS 7.6 · 2023-11-22 | 7.6 | 0.9% | 2023-11-22 |
| CVE-2024-38865Livestatus command injection in RestAPICheckmk GmbH · Checkmk · CVSS 6 · 2025-04-10 | 6.0 | 0.9% | 2025-04-10 |
| CVE-2023-6156Livestatus injection in availability timelineCheckmk GmbH · Checkmk · CVSS 7.6 · 2023-11-22 | 7.6 | 0.9% | 2023-11-22 |
| CVE-2024-42482fish-shop/syntax-check Improper Neutralization of Delimitersfish-shop · syntax-check · CVSS 4.8 · 2024-08-12 | 4.8 | 0.8% | 2024-08-12 |
| CVE-2025-47779Using malformed From header can forge identity with ";" or NULL in name portionasterisk · asterisk · CVSS 7.7 · 2025-05-22 | 7.7 | 0.5% | 2025-05-22 |
| CVE-2024-6542Livestatus injection in mknotifydCheckmk GmbH · Checkmk · CVSS 6.5 · 2024-07-22 | 6.5 | 0.5% | 2024-07-22 |
| CVE-2024-38866Livestatus Injection in dynmapsNagvis · Nagvis · CVSS 5.3 · 2025-05-27 | 5.3 | 0.4% | 2025-05-27 |
| CVE-2025-32918Livestatus injection in autocomplete endpointCheckmk GmbH · Checkmk · CVSS 5.3 · 2025-07-04 | 5.3 | 0.4% | 2025-07-04 |
| CVE-2026-21691iccDEV has Type Confusion in CIccTag:IsTypeCompressed()InternationalColorConsortium · iccDEV · CVSS 5.4 · 2026-01-07 | 5.4 | 0.3% | 2026-01-07 |
| CVE-2025-48879OctoPrint Vulnerable to Denial of Service through malformed HTTP requestOctoPrint · OctoPrint · CVSS 6.5 · 2025-06-10 | 6.5 | 0.3% | 2025-06-10 |
| CVE-2024-42392Improper Neutralization of Delimiters in Mongoose Web Server libraryCesanta · Mongoose Web Server · CVSS 4 · 2024-11-18 | 4.0 | 0.2% | 2024-11-18 |
| CVE-2026-33456Potential livestatus injection in notification testCheckmk GmbH · Checkmk · CVSS 5.1 · 2026-04-10 | 5.1 | 0.2% | 2026-04-10 |
| CVE-2026-124028mistral.rs before 0.9.5 Tool Call Injection via mistralrs-core Output ParsersEricLBuehler · mistral.rs · CVSS 4.2 · 2026-11-06 | 4.2 | 0.2% | 2026-11-06 |
| CVE-2026-33457Potential livestatus injection in prediction graph pageCheckmk GmbH · Checkmk · CVSS 5.3 · 2026-04-10 | 5.3 | 0.2% | 2026-04-10 |
| CVE-2026-33455Livestatus injection in monitoring quicksearchCheckmk GmbH · Checkmk · CVSS 5.3 · 2026-04-10 | 5.3 | 0.2% | 2026-04-10 |
| CVE-2025-52989Junos OS and Junos OS Evolved: Annotate configuration command can be used to change the configurationJuniper Networks · Junos OS · CVSS 5.1 · 2025-07-11 | 5.1 | 0.1% | 2025-07-11 |
| CVE-2026-104047Sssd: sssd: information disclosure via query injection in entra id lookupsRed Hat · Red Hat Enterprise Linux 10 · CVSS 5.3 · 2026-10-06 | 5.3 | 0.1% | 2026-10-06 |
| CVE-2024-42385Improper Neutralization of Delimiters in Mongoose Web Server libraryCesanta · Mongoose Web Server · CVSS 4 · 2024-11-18 | 4.0 | 0.1% | 2024-11-18 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.