CWE-172 · Injection and Smuggling
Improper Encoding or Decoding of Data
22CVEs
SortMost likely exploited
22 CVEs with CWE-172 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2019-10160A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 throu…Python · python · CVSS 9.8 · 2019-06-07 | 9.8 | 5.2% | 2019-06-07 |
| CVE-2019-10153A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm to exit with an exc…ClusterLabs · fence-agents · CVSS 5 · 2019-07-30 | 5.0 | 2.2% | 2019-07-30 |
| CVE-2018-7289An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames containing pure UTF-16 characters can bypass detection. The use…Teclib-Edition · Armadito Antivirus · 2018-02-21 | – | 1.7% | 2018-02-21 |
| CVE-2019-12677Cisco Adaptive Security Appliance Software SSL VPN Denial of Service VulnerabilityCisco · Cisco Adaptive Security Appliance (ASA) Software · CVSS 7.7 · 2019-10-02 | 7.7 | 1.5% | 2019-10-02 |
| CVE-2016-6691service/jni/com_android_server_wifi_Gbk2Utf.cpp in the Qualcomm Wi-Fi gbk2utf module in Android before 2016-10-05 allows remote attackers to cause a denial of service (framework c…Google · Android · 2016-10-10 | – | 1.3% | 2016-10-10 |
| CVE-2018-2415SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50)…SAP SE · SAP NetWeaver Application Server (Engine API) · CVSS 4.7 · 2018-05-09 | 4.7 | 1.1% | 2018-05-09 |
| CVE-2018-7173A large loop in JBIG2Stream::readSymbolDictSeg in xpdf 4.00 allows an attacker to cause denial of service via a specific file due to inappropriate decoding.Xpdfreader · Xpdf · 2018-02-15 | – | 0.8% | 2018-02-15 |
| CVE-2016-3829The ih264d decoder in mediaserver in Android 6.x before 2016-08-01 does not initialize certain structure members, which allows remote attackers to cause a denial of service (devic…Google · Android · 2016-08-05 | – | 0.6% | 2016-08-05 |
| CVE-2016-3828decoder/ih264d_api.c in mediaserver in Android 6.x before 2016-08-01 mishandles invalid PPS and SPS NAL units, which allows remote attackers to cause a denial of service (device h…Google · Android · 2016-08-05 | – | 0.6% | 2016-08-05 |
| CVE-2016-3827codecs/hevcdec/SoftHEVC.cpp in libstagefright in mediaserver in Android 6.0.1 before 2016-08-01 mishandles decoder errors, which allows remote attackers to cause a denial of servi…Google · Android · 2016-08-05 | – | 0.6% | 2016-08-05 |
| CVE-2026-106122RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumersrabbitmq · rabbitmq-java-client · CVSS 6 · 2026-10-06 | 6.0 | 0.5% | 2026-10-06 |
| CVE-2025-27110Libmodsecurity3 has possible bypass of encoded HTML entitiesowasp-modsecurity · ModSecurity · CVSS 7.9 · 2025-02-25 | 7.9 | 0.5% | 2025-02-25 |
| CVE-2026-48784Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalizationsymfony · symfony · CVSS 5.1 · 2026-07-14 | 5.1 | 0.3% | 2026-07-14 |
| CVE-2026-95101NGINX ngx_http_v3_module vulnerabilityF5 · NGINX Plus · CVSS 5.3 · 2026-10-14 | 5.3 | 0.3% | 2026-10-14 |
| CVE-2026-42926NGINX ngx_http_proxy_v2_module vulnerabilityF5 · NGINX Open Source · CVSS 5.8 · 2026-05-13 | 5.8 | 0.3% | 2026-05-13 |
| CVE-2026-104774OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypasscorazawaf · coraza · CVSS 5.8 · 2026-10-12 | 5.8 | 0.3% | 2026-10-12 |
| CVE-2024-48909SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is notauthzed · spicedb · CVSS 2 · 2024-10-14 | 2.0 | 0.3% | 2024-10-14 |
| CVE-2026-61812ModSecurity: HTML decoder missing entities, leading to evasionowasp-modsecurity · ModSecurity · CVSS 6.3 · 2026-11-09 | 6.3 | 0.3% | 2026-11-09 |
| CVE-2026-100891Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding errorTrusted Domain Project · OpenDMARC · CVSS 7.3 · 2026-09-28 | 7.3 | 0.3% | 2026-09-28 |
| CVE-2021-33604Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19Vaadin · Vaadin · CVSS 2.5 · 2021-06-24 | 2.5 | 0.3% | 2021-06-24 |
| CVE-2026-86818fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronizationfast-uri · fast-uri · CVSS 4.8 · 2026-09-15 | 4.8 | 0.3% | 2026-09-15 |
| CVE-2026-110306fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decodingfast-uri · fast-uri · CVSS 6.1 · 2026-10-20 | 6.1 | 0.3% | 2026-10-20 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.