Python CPython Morsel JS Output Code Execution

The vulnerability of the http.cookies.Morsel.jsOutput method in the Python programming language interpreter CPython is related to incorrect encoding or escaping of output data. Exploiting this vulnerability can allow a remote attacker to exploit the system. source-iocs-preserved...

Improper Encoding or Escaping of Output

Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to Improper Encodin...

CVE-2026-83610: Improper Encoding or Escaping of Output

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReferencename accepts an invalid name and the ENTITYREFERENCENODE serializer...

CVE-2026-82681

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

EUVD-2026-68327

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

CVE-2026-82681

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

EEF-CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Summary Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicin...

CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

CVE-2026-82681

ash-project ash_admin (Elixir admin panel) contains a query-parameter injection in the Table, DataTable, and Show components. Row-action URLs were built via raw string interpolation of the primary key without URL-encoding. Because the primary key is spliced last into the query string and Plug.Con...

CVE-2026-82681: Improper Encoding or Escaping of Output

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

PT-2026-83684

Improper Encoding or Escaping of Output vulnerability in ash-project ash admin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

CVE-2026-55859 MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to charactersetclien...

CVE-2026-55859

MariaDB Connector/R2DBC (org.mariadb:r2dbc-mariadb) is a non-blocking Java client for MariaDB and MySQL. Prior to 1.4.1 , the driver encodes and decodes all character data assuming the connection character set is UTF-8 . A server can announce a mid-session change to character_set_client through t...

CVE-2026-55859 MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to charactersetclien...

EUVD-2026-68022

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to charactersetclien...

CVE-2026-55859 MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to charactersetclien...

CVE-2026-55891: Improper Encoding or Escaping of Output

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri in lib/Request.php passes $SERVER'REQUESTURI' through FILTERSANITIZEURL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::init stores t...

CVE-2026-82249: Improper Encoding or Escaping of Output

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts...

Security Bulletin: IBM Sterling Control Center is affected by a vulnerability in jetty-ee8-security jar (CVE-2026-10050)

Summary IBM Sterling Control Center is affected by a vulnerability CVE-2026-10050 reported for jetty-ee8-security-12.0.25.jar Vulnerability Details CVEID:CVE-2026-10050 DESCRIPTION: In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes...

CVE-2026-81522: Improper Encoding or Escaping of Output

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different...