CWE-86 · Cross-site Scripting
Improper Neutralization of Invalid Characters in Identifiers in Web Pages
11CVEs
0exploited
0with a public check
0likely (EPSS 10%+)
SortMost likely exploited
11 CVEs with CWE-86 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-28417Vim has OS Command Injection in netrwvim · vim · CVSS 4.4 · 2026-02-27 | 4.4 | 1.4% | 2026-02-27 |
| CVE-2023-31126Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xmlxwiki · xwiki-commons · CVSS 9.1 · 2023-05-09 | 9.1 | 0.8% | 2023-05-09 |
| CVE-2023-22840Improper neutralization in software for the Intel(R) oneVPL GPU software before version 22.6.5 may allow an authenticated user to potentially enable denial of service via local ac…Intel · Intel(R) oneVPL GPU software · CVSS 3.3 · 2023-08-11 | 3.3 | 0.4% | 2023-08-11 |
| CVE-2024-10941A malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash. This vulnerability affects Firefox < 126.Mozilla · Firefox · CVSS 4.3 · 2024-11-06 | 4.3 | 0.4% | 2024-11-06 |
| CVE-2025-20166Cisco Common Services Platform Collector Cross-Site Scripting VulnerabilityCisco · Cisco Common Services Platform Collector Software · CVSS 5.4 · 2025-01-08 | 5.4 | 0.4% | 2025-01-08 |
| CVE-2026-71478league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytesthephpleague · commonmark · CVSS 6.1 · 2026-08-06 | 6.1 | 0.4% | 2026-08-06 |
| CVE-2024-21864Improper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.5081 may allow an unauthenticated user to potentially enable escalation of…Intel(R) Arc(TM) & Iris(R) Xe Graphics software · CVSS 7.8 · 2024-05-16 | 7.8 | 0.3% | 2024-05-16 |
| CVE-2025-20168Cisco Common Services Platform Collector Cross-Site Scripting VulnerabilityCisco · Cisco Common Services Platform Collector Software · CVSS 5.4 · 2025-01-08 | 5.4 | 0.3% | 2025-01-08 |
| CVE-2025-20167Cisco Common Services Platform Collector Cross-Site Scripting VulnerabilityCisco · Cisco Common Services Platform Collector Software · CVSS 5.4 · 2025-01-08 | 5.4 | 0.3% | 2025-01-08 |
| CVE-2025-66606A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly encode URLs. An attacker could tamper with web pages or exec…Yokogawa Electric Corporation · FAST/TOOLS · CVSS 2.1 · 2026-02-09 | 2.1 | 0.3% | 2026-02-09 |
| CVE-2021-33158Improper neutralization in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable escalatio…Intel · Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability… · CVSS 7.2 · 2024-05-16 | 7.2 | 0.2% | 2024-05-16 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.