Improper Neutralization of Special Elements in Data Query Logic

Overview apache-airflow-providers-google is a Provider for Apache Airflow. Implements apache-airflow-providers-google package Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via GoogleDriveHook in drive.py, where folder names, fi...

CVE-2026-75650

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-75650 CVE-2026-75650 Magento Open Source 2.4.8-p5 — Adobe Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the conte...

Improper Neutralization of Special Elements Used in a Template Engine

Overview compliance-trestle is a Tools to manage & autogenerate python objects representing the OSCAL layers/models Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the parse method in trestle/core/jinja/tags.py, where...

CVE-2026-94124: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in WP EasyCart = 5.9.4 versions...

CVE-2026-18137

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a flaw that could allow a remote attacker to execute arbitrary ESQL commands . The root cause is the improper neutralization of special elements used in an ESQL command. The vulnerability has a HIGH base severity (CVSS ...

CVE-2026-20130: Improper Neutralization of Special Elements in Output Used by a Downstream Component

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

CVE-2026-53658: Improper Neutralization of Special Elements used in an LDAP Query

Fabric CA is a Certificate Authority for Hyperledger Fabric. Prior to 1.5.21, when fabric-ca is configured with an LDAP backend, Client.GetUser in lib/server/ldap/client.go inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters...

CVE-2026-91986: Improper Neutralization of Special Elements in Output Used by a Downstream Component

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via improper neutralization of special elements in the GridFS process. An attacker can access unauthorized file content or delete all file chunks by injecting query operato...

CVE-2026-88024: Improper Neutralization of Special Elements in Data Query Logic

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88033: Improper Neutralization of Special Elements in Data Query Logic

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88030: Improper Neutralization of Special Elements in Data Query Logic

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via improper validation of database and collection names. An attacker can access or manipulate unintended databases or collections by supplying input containing prohibited...

CVE-2026-77129: Improper Neutralization of Special Elements Used in a Template Engine

The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript conte...

CVE-2026-53572: Improper Neutralization of Special Elements in Output Used by a Downstream Component

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

CVE-2026-76321: Improper Neutralization of Special Elements used in a Command

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary Search Processing Language SPL into requests that search for events near a selected event. This could allow for unauthorized search execution. The vulnerability is possible becau...

CVE-2026-76349: Improper Neutralization of Special Elements in Data Query Logic

In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Processing Language SPL commands using the permissions of the authenticated user through a crafted Splunk Web link. The SPL commands could access...

CVE-2026-53533: Improper Neutralization of Special Elements used in a Command

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail, SMTP.rcpt, SMTP.vrfy, and SMTP.expn send caller-supplied addresses without rejecting embedded CR or LF bytes. Data after the line break is framed as additional standalone SMTP command lines, allowing an...

CVE-2026-63298

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.' configuration...

CVE-2026-70395: Improper Neutralization of Special Elements in Data Query Logic

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When managerelationship is used with onlookup: :relate on a belongsto...