CWE-159 · Injection and Smuggling
Improper Handling of Invalid Use of Special Elements
12CVEs
SortMost likely exploited
12 CVEs with CWE-159 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2021-21707Special characters break path parsing in XML functionsPHP Group · PHP · CVSS 5.3 · 2021-11-29 | 5.3 | 25% | 2021-11-29 |
| CVE-2019-9505PrinterLogic Print Management Software does not sanitize special charactersPrinterLogic · Management Software · 2019-05-08 | – | 3.5% | 2019-05-08 |
| CVE-2020-1653Junos OS: Kernel crash (vmcore) or FPC crash due to mbuf leakJuniper Networks · Junos OS · CVSS 7.5 · 2020-07-17 | 7.5 | 1.6% | 2020-07-17 |
| CVE-2020-1648Junos OS and Junos OS Evolved: RPD crash when processing a specific BGP packetJuniper Networks · Junos OS · CVSS 7.5 · 2020-07-17 | 7.5 | 1.3% | 2020-07-17 |
| CVE-2020-1646Junos OS and Junos OS Evolved: RPD crash while processing a specific BGP update information.Juniper Networks · Junos OS · CVSS 7.5 · 2020-07-17 | 7.5 | 1.0% | 2020-07-17 |
| CVE-2020-29022Host Header Injection allowing web cache poisoning attacksSecomea · GateManager · CVSS 5.3 · 2021-02-16 | 5.3 | 0.8% | 2021-02-16 |
| CVE-2026-2636Denial of Service in Microsoft OSMicrosoft · Windows OS · CVSS 5.5 · 2026-02-25 | 5.5 | 0.5% | 2026-02-25 |
| CVE-2025-61984ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand…OpenBSD · OpenSSH · CVSS 3.6 · 2025-10-06 | 3.6 | 0.5% | 2025-10-06 |
| CVE-2024-51500Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmwaremeshtastic · firmware · CVSS 5.3 · 2024-11-04 | 5.3 | 0.4% | 2024-11-04 |
| CVE-2025-52884risc0-ethereum-contracts allows invalid commitment with digest value of zero to be accepted by Steel.validateCommitmentrisc0 · risc0-ethereum · CVSS 1.7 · 2025-06-24 | 1.7 | 0.4% | 2025-06-24 |
| CVE-2021-42375An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characte…busybox · busybox · CVSS 5.5 · 2021-11-15 | 5.5 | 0.4% | 2021-11-15 |
| CVE-2026-35536In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted charact…tornadoweb · Tornado · CVSS 7.2 · 2026-04-03 | 7.2 | 0.2% | 2026-04-03 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.