org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation

An improper input neutralization flaw has been discovered in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a...

CVE-2026-86522: Improper Output Neutralization for Logs

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...

CVE-2026-20330

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal securi...

CVE-2026-20130

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) are affected by multiple internally discovered vulnerabilities grouped under CWE-74 (Improper Neutralization of Special Elements), addressed as part of a software hardening release following an internal securi...

CVE-2026-20130 Cisco Identity Services Engine Hardening Release - Improper Neutralization Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

EUVD-2026-81106

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

CVE-2026-20330

CVE-2026-20330 is a critical (CVSS 9.9) vulnerability in Cisco Secure ASA , Cisco Secure FTD , and Cisco Secure FMC software, arising from improper neutralization weaknesses (CWE-707). The issues were found via Cisco's internal security review and are addressed in a software hardening release . T...

EUVD-2026-81097

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal securi...

CVE-2026-20330 Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Improper Neutralization Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal securi...

CVE-2026-20330 Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Improper Neutralization Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal securi...

Improper Output Neutralization for Logs

Overview org.apache.zookeeper:zookeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs in the audit logging...

CVE-2026-92132: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...

CVE-2026-20330: Improper Neutralization

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal securi...

PT-2026-93984

Name of the Vulnerable Software and Affected Versions Cisco Secure Adaptive Security Appliance Software affected versions not specified Cisco Secure Firewall Threat Defense Software affected versions not specified Cisco Secure Firewall Management Center Software affected versions not specified...

CVE-2026-20130: Improper Neutralization of Special Elements in Output Used by a Downstream Component

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

PT-2026-93953

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description An issue exists involving the improper neutralization of special elements, which falls...

CVE-2026-91937: Improper Neutralization of Special Elements in Data Query Logic

Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can submit MongoDB operator objects through the prediction API to read chat history records belonging to other users from the...

CVE-2026-91986: Improper Neutralization of Special Elements in Output Used by a Downstream Component

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

CVE-2026-53658: Improper Neutralization of Special Elements used in an LDAP Query

Fabric CA is a Certificate Authority for Hyperledger Fabric. Prior to 1.5.21, when fabric-ca is configured with an LDAP backend, Client.GetUser in lib/server/ldap/client.go inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters...

CVE-2026-55887: Improper Neutralization of Argument Delimiters in a Command

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...