CWE-176 · Injection and Smuggling
Improper Handling of Unicode Encoding
39CVEs
SortMost likely exploited
39 CVEs with CWE-176 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-43093In CISA KEVExploitedIn shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicod…Google · Android · CVSS 7.3 · 2024-11-13 | 7.3 | 0.7% | 2024-11-13 |
| CVE-2026-48618A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname…nodejs · node · CVSS 7.7 · 2026-06-26 | 7.7 | 3.1% | 2026-06-26 |
| CVE-2024-24691Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input ValidationZoom Video Communications, Inc. · Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting… · CVSS 9.6 · 2024-02-14 | 9.6 | 1.7% | 2024-02-14 |
| CVE-2023-39213Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticated user to enable an escalation of privi…Zoom Video Communications, Inc. · Zoom Desktop Client for Windows and Zoom VDI Client · CVSS 9.6 · 2023-08-08 | 9.6 | 1.4% | 2023-08-08 |
| CVE-2026-105241Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batchApache Software Foundation · Apache log4net · CVSS 5.3 · 2026-10-06 | 5.3 | 0.8% | 2026-10-06 |
| CVE-2026-45062FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Filesphp · frankenphp · CVSS 8.1 · 2026-06-10 | 8.1 | 0.7% | 2026-06-10 |
| CVE-2023-41889Late-Unicode normalization vulnerability in SHIRASAGIshirasagi · shirasagi · CVSS 5.3 · 2023-09-15 | 5.3 | 0.7% | 2023-09-15 |
| CVE-2026-45135Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Filescaddyserver · caddy · CVSS 8.1 · 2026-06-23 | 8.1 | 0.7% | 2026-06-23 |
| CVE-2026-4114Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication.SonicWall · SMA1000 · CVSS 6.6 · 2026-04-09 | 6.6 | 0.6% | 2026-04-09 |
| CVE-2025-71316SQLite sqldiff remote code execution via argument injectionSQLite · sqldiff · CVSS 9.8 · 2026-06-04 | 9.8 | 0.5% | 2026-06-04 |
| CVE-2026-59890setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+pypa · setuptools · CVSS 6.1 · 2026-07-08 | 6.1 | 0.5% | 2026-07-08 |
| CVE-2023-52081ewen-lbh/ffcss late-Unicode normalization vulnerabilityewen-lbh · ffcss · CVSS 5.3 · 2023-12-28 | 5.3 | 0.5% | 2023-12-28 |
| CVE-2026-89074MOVEit Transfer Email MFA BypassProgress · MOVEit Transfer · CVSS 7.5 · 2026-10-14 | 7.5 | 0.5% | 2026-10-14 |
| CVE-2020-8929Ciphertext integrity weakness in TinkGoogle LLC · Tink · CVSS 5.3 · 2020-10-19 | 5.3 | 0.5% | 2020-10-19 |
| CVE-2026-25480FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)litestar-org · litestar · CVSS 6.5 · 2026-02-09 | 6.5 | 0.5% | 2026-02-09 |
| CVE-2026-7040Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have heap overflow when processing some malformed UTF-8 charactersRRWO · Text::Minify::XS · CVSS 7.5 · 2026-04-27 | 7.5 | 0.4% | 2026-04-27 |
| CVE-2026-4116Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication.SonicWall · SMA1000 · CVSS 7.2 · 2026-04-09 | 7.2 | 0.4% | 2026-04-09 |
| CVE-2023-31169Improper Handling of Unicode EncodingSchweitzer Engineering Laboratories · SEL-5030 acSELerator QuickSet Software · CVSS 4.8 · 2023-08-31 | 4.8 | 0.4% | 2023-08-31 |
| CVE-2026-110687Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmpNo vendor recorded · CVSS 7.5 · 2026-10-19 | 7.5 | 0.4% | 2026-10-19 |
| CVE-2026-93990Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogatelibexpat · libexpat · CVSS 7.5 · 2026-09-19 | 7.5 | 0.4% | 2026-09-19 |
| CVE-2026-93751uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecCharsgarycourt · uri-js · CVSS 6.5 · 2026-09-18 | 6.5 | 0.4% | 2026-09-18 |
| CVE-2026-86105Fireware OS Improper Authorization in Access Portal Reverse ProxyWatchGuard · Fireware OS · CVSS 5.3 · 2026-09-29 | 5.3 | 0.3% | 2026-09-29 |
| CVE-2026-44288protobufjs: Overlong UTF-8 decodingprotobufjs · protobuf.js · CVSS 5.3 · 2026-05-13 | 5.3 | 0.3% | 2026-05-13 |
| CVE-2025-55129HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonation attacks after the fix for CVE-2025-52…Revive · Revive Adserver · CVSS 5.4 · 2025-12-02 | 5.4 | 0.3% | 2025-12-02 |
| CVE-2026-23950node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFSisaacs · node-tar · CVSS 8.8 · 2026-01-20 | 8.8 | 0.3% | 2026-01-20 |
| CVE-2017-20190Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side performance degradation during processing of multiple Unicode combining characters, aka a…No vendor recorded · 2024-03-26 | – | 0.3% | 2024-03-26 |
| CVE-2025-59547DNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscationdnnsoftware · Dnn.Platform · CVSS 5.3 · 2025-09-23 | 5.3 | 0.3% | 2025-09-23 |
| CVE-2026-114114Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Charactersvyperlang · vyper · CVSS 5.3 · 2026-10-21 | 5.3 | 0.3% | 2026-10-21 |
| CVE-2026-20202Improper Input Validation during User Account Creation in Splunk EnterpriseSplunk · Splunk Enterprise · CVSS 6.6 · 2026-04-15 | 6.6 | 0.3% | 2026-04-15 |
| CVE-2026-126349Addressable display_uri can show misleading hosts containing bidi and invisible characterssporkmonger · addressable · CVSS 3.1 · 2026-11-12 | 3.1 | 0.2% | 2026-11-12 |
| CVE-2026-19954Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain namesNo vendor recorded · CVSS 5.4 · 2026-10-05 | 5.4 | 0.2% | 2026-10-05 |
| CVE-2026-116542Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decodingnetty · netty-tcnative · CVSS 5.3 · 2026-10-26 | 5.3 | 0.2% | 2026-10-26 |
| CVE-2024-8067Unicode "best fit" argument injectionHelix · Helix Core · CVSS 5.8 · 2024-09-24 | 5.8 | 0.2% | 2024-09-24 |
| CVE-2022-29812In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficientJetBrains · IntelliJ IDEA · CVSS 2.3 · 2022-04-28 | 2.3 | 0.2% | 2022-04-28 |
| CVE-2026-81869OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncationopen-telemetry · opentelemetry-go · CVSS 5.1 · 2026-09-16 | 5.1 | 0.2% | 2026-09-16 |
| CVE-2026-35346uutils coreutils comm Silent Data Corruption via Lossy UTF-8 NormalizationUutils · coreutils · CVSS 3.3 · 2026-04-22 | 3.3 | 0.2% | 2026-04-22 |
| CVE-2026-35375uutils coreutils split Local Data Integrity Issue via Lossy Filename EncodingUutils · coreutils · CVSS 3.3 · 2026-04-22 | 3.3 | 0.1% | 2026-04-22 |
| CVE-2026-14978Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusionsHashiCorp · go-slug · CVSS 5.5 · 2026-08-19 | 5.5 | 0.1% | 2026-08-19 |
| CVE-2026-35373uutils coreutils ln Local Denial of Service via Improper Handling of Non-UTF-8 FilenamesUutils · coreutils · CVSS 3.3 · 2026-04-22 | 3.3 | 0.1% | 2026-04-22 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.