CVE-2026-34491

A persistent cross-site scripting (XSS) vulnerability in the web interface of Johnson Controls Metasys (a building management system) allows a low-privilege user to inject a malicious payload via a crafted URL. The payload persists across logins and executes in the browser context of other users,...

PT-2026-80980

Name of the Vulnerable Software and Affected Versions Metasys versions prior to 14.1.5 Metasys versions prior to 15.0.1 Description Improper neutralization of input during web page generation allows Cross Site Scripting XSS, a condition where malicious scripts are injected into trusted websites...

CVE-2026-78140: Improper Neutralization of Special Elements Used in a Template Engine

A flaw has been found in Dromara UJCMS up to 10.1.3. The impacted element is the function update of the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the component web-file-template Endpoint. Executing a manipulation can lead to improper neutralization of...

CVE-2026-77810: Improper Neutralization of Directives in Dynamically Evaluated Code

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...

CVE-2026-53572: Improper Neutralization of Special Elements in Output Used by a Downstream Component

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

EUVD-2026-63400

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to...

CVE-2026-16926

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input...

Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

Improper neutralization of argument delimiters in a command 'argument injection' in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network...

Azure SQL Database Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

CVE-2026-16926: External Control of File Name or Path

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input...

Improper Neutralization

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Improper Neutralization in the...

CVE-2026-55558: Improper Neutralization of Special Elements in Output Used by a Downstream Component

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...

EUVD-2026-62871

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16844 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16844 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-20231

CVE-2026-20231 is a set of improper neutralization of special elements vulnerabilities (CWE-74) in Cisco Secure Workload , affecting both SaaS and on-premises deployments. The issues span command injection , operating system injection , and argument injection , and carry a CVSS 3.1 score of 9.9 (...

EUVD-2026-62561

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-20231 Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Neutralization of Special Elements Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-20231 Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Neutralization of Special Elements Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

EUVD-2026-62560

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...