Zimbra Collaboration Suite < 8.8.15 - Improper Encoding

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 update 1, as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing...

CVE-2026-79952

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Encoding or Escaping of Output vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to launch of...

CVE-2026-79952

Dell Secure Connect Gateway (SCG) 5.0 is affected by an Improper Encoding or Escaping of Output vulnerability in both the Appliance (versions prior to 5.36.00.16 ) and Application (versions prior to 5.36.00.00 ). An unauthenticated attacker with remote network access could exploit this flaw to la...

CVE-2026-79952

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Encoding or Escaping of Output vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to launch of...

EUVD-2026-75013

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Encoding or Escaping of Output vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to launch of...

Security Bulletin: Due to use of log4j-core, IBM webMethods BPM is vulnerable to ImproperImproper Encoding or Escaping of Output

Summary IBM webMethods BPM is dependant on log4j-core which is affected by known vulnerability - CVE-2026-34480 Vulnerability Details CVEID:CVE-2026-34480 DESCRIPTION: Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.htmlXmlLayout , in versions up to and including...

DEBIAN-CVE-2026-87550

Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87550

CVE-2026-87550 is an improper encoding or escaping flaw in CSS output in Google Chrome prior to 153.0.8010.36 , allowing a remote attacker to bypass the web origin policy via a crafted HTML page. The Chromium security team rated the severity as Medium (CVSS 4.3), requiring user interaction with n...

CVE-2026-69821

Improper encoding or escaping of output in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges locally...

CVE-2026-69821

CVE-2026-69821 is a local privilege escalation vulnerability in Active Directory Certificate Services (AD CS) caused by improper encoding or escaping of output. An authorized attacker with low privileges can exploit it without user interaction to gain full compromise of confidentiality, integrity...

EUVD-2026-73569

Improper encoding or escaping of output in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges locally...

Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability

Improper encoding or escaping of output in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges locally...

CVE-2026-43971

A flaw was found in ninenines cowlib. This vulnerability, due to improper encoding or escaping of output, allows an attacker to perform Link header directive smuggling. By manipulating the target URI, 'rel' value, or attribute keys in applications that process Link headers through cowlib, a remot...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Improper Encoding or Escaping of Output due to Apache Log4j (CVE-2026-49844)

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Improper Encoding or Escaping of Output due to Apache Log4j. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in...

Security Bulletin: IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Operational Decision Manager Vulnerability Details CVEID:CVE-2026-54515 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and...

Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...

The vulnerability of the http.cookies.Morsel.jsOutput() method in the Python programming language interpreter (CPython) allows a hacker to execute arbitrary code. [source-iocs-preserved method=http.cookies.Morsel.js_output()]

The vulnerability of the http.cookies.Morsel.jsOutput method in the Python programming language interpreter CPython is related to incorrect encoding or escaping of output data. Exploiting this vulnerability can allow a remote attacker to exploit the system. source-iocs-preserved...

CVE-2026-82681

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

CVE-2026-82681

ash-project ash_admin (Elixir admin panel) contains a query-parameter injection in the Table, DataTable, and Show components. Row-action URLs were built via raw string interpolation of the primary key without URL-encoding. Because the primary key is spliced last into the query string and Plug.Con...

EEF-CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Summary Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicin...