CVE-2026-78140: Improper Neutralization of Special Elements Used in a Template Engine

A flaw has been found in Dromara UJCMS up to 10.1.3. The impacted element is the function update of the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the component web-file-template Endpoint. Executing a manipulation can lead to improper neutralization of...

CVE-2026-53572: Improper Neutralization of Special Elements in Output Used by a Downstream Component

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

CVE-2026-77810: Improper Neutralization of Directives in Dynamically Evaluated Code

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...

EUVD-2026-63400

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to...

Azure SQL Database Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

Improper Neutralization

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Improper Neutralization in the...

CVE-2026-55558: Improper Neutralization of Special Elements in Output Used by a Downstream Component

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...

CVE-2026-16844 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-20231

CVE-2026-20231 is a set of improper neutralization of special elements vulnerabilities (CWE-74) in Cisco Secure Workload , affecting both SaaS and on-premises deployments. The issues span command injection , operating system injection , and argument injection , and carry a CVSS 3.1 score of 9.9 (...

EUVD-2026-62561

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-20231 Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Neutralization of Special Elements Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-20231 Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Neutralization of Special Elements Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-15068 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16019

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Faydam Innovation Inc. FAYDAM Datalogger allows SQL Injection. This issue affects FAYDAM Datalogger: from 2.7.1 before 2.8.0...

EUVD-2026-62438

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Faydam Innovation Inc. FAYDAM Datalogger allows SQL Injection. This issue affects FAYDAM Datalogger: from 2.7.1 before 2.8.0...

CVE-2026-16019

FAYDAM Datalogger (by Faydam Innovation Inc.) is affected by a SQL injection vulnerability due to improper neutralization of special elements in SQL commands. The issue affects versions 2.7.1 through before 2.8.0 and carries a CVSS 3.1 score of 9.8 (CRITICAL) with a network attack vector requirin...

CVE-2026-76349: Improper Neutralization of Special Elements in Data Query Logic

In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Processing Language SPL commands using the permissions of the authenticated user through a crafted Splunk Web link. The SPL commands could access...

CVE-2026-76321: Improper Neutralization of Special Elements used in a Command

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary Search Processing Language SPL into requests that search for events near a selected event. This could allow for unauthorized search execution. The vulnerability is possible becau...

PT-2026-78492

Name of the Vulnerable Software and Affected Versions Cisco Secure Workload affected versions not specified Description Multiple issues exist involving the improper neutralization of special elements, which can lead to security risks. This is categorized under CWE-74, which refers to the failure ...

PT-2026-78373

Name of the Vulnerable Software and Affected Versions FAYDAM Datalogger versions 2.7.1 through 2.7.x Description Improper neutralization of special elements used in an SQL command allows for SQL injection. This occurs when the application fails to properly sanitize user-supplied data before...