By weakness (CWE)

CWE-116: related vulnerabilities

CVEs classified under CWE-116. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

18 published vulnerabilities

• CVE-2026-12044HIGH 8.8

  A SQL injection flaw in pgAdmin 4 allows an authenticated user to break out of database description fields by injecting a single quote, then execute arbitrary SQL commands. The vulnerability exists across 16 template locations where user-supplied descriptions are rendered directly into SQL without proper escaping—in dialogs for Domains, Foreign Tables, Languages, Event Triggers, and Views. An attacker with superuser or similar elevated database roles could escalate further to run OS commands on the PostgreSQL host. However, the flaw does not grant new database access; it only bypasses application-layer controls a DBA may have configured to restrict direct SQL execution.

• CVE-2026-56379HIGH 8.1

  ImageMagick, a widely-used open-source image processing library, contains a command injection vulnerability in how it handles SVG (Scalable Vector Graphics) files. An attacker can create a malicious SVG file that injects Magick Vector Graphics (MVG) commands, which are then executed during image rendering. This could allow an attacker to run arbitrary code on systems processing untrusted SVG files. The vulnerability affects ImageMagick versions before 7.1.2-15 (version 7.x branch) and before 6.9.13-40 (version 6.x branch).

• CVE-2026-49091HIGH 8.0

  Kibana contains a flaw where specially crafted input can be injected into log files without being properly cleaned or neutralized. When those logs are later displayed in a terminal, the injected content may include control sequences that alter what the user sees—potentially masking real activity, inserting false entries, or manipulating audit trails. An attacker must have valid credentials to exploit this, and the victim must view the compromised logs in an affected terminal. This creates a risk to log integrity and could complicate incident investigation or compliance audits.

• CVE-2026-8795HIGH 7.8

  Rapid7 Velociraptor contains a vulnerability where specially crafted evidence collections can inject malicious code into YAML configuration files. When a security analyst processes a compromised collection using Velociraptor's remapping feature, arbitrary commands execute on their workstation with full permissions. The attack requires an attacker to control a collection ZIP file (obtained through network compromise or social engineering) and a user to run a specific analysis command. This is a local privilege escalation risk for incident response teams.

• CVE-2026-54699HIGH 7.7

  Warp, a terminal-based development environment designed for WSL (Windows Subsystem for Linux), has a command injection vulnerability affecting versions from March 2024 through early May 2026. When Warp fails to open a URL through its primary WSL mechanism (wslview), it falls back to Windows command processing. An attacker can craft malicious URLs that appear in terminal output; when a developer clicks such a link, arbitrary OS commands execute with the user's privileges. The vulnerability requires user interaction but can cross security boundaries, making it a meaningful risk in shared or compromised terminal environments.

• CVE-2026-42558HIGH 7.6

  Xibo, an open-source digital signage platform, contains a vulnerability that allows privileged users to inject malicious code that breaks out of a security sandbox and executes in the browser. This is a chained vulnerability combining stored cross-site scripting (XSS) with an iframe sandbox escape. To exploit it, an attacker must already have administrative privileges to create datasets and configure data connectors—capabilities not available to standard users. The vulnerability affects Xibo versions before 4.4.2.

• CVE-2026-54013HIGH 7.6

  Open WebUI is an offline-capable AI platform that stores user and model metadata, including profile images. A security fix applied to user and webhook profile images in version 0.9.6 was incompletely implemented—model profile images were overlooked. Any authenticated user with default workspace permissions can upload a malicious SVG image disguised as a model's profile picture. When another user views that image, the embedded JavaScript executes in their browser with full account privileges, enabling complete account takeover. The vulnerability requires an authenticated attacker and user interaction, but the permissions involved are enabled by default.

• CVE-2026-45011HIGH 7.3

  ApostropheCMS version 4.29.0 contains a stored cross-site scripting (XSS) flaw in its image widget feature. An Editor-level user can inject malicious JavaScript code into an image link, and because editors can publish content directly to the live site, that payload executes whenever anyone—including administrators or public visitors—interacts with the affected widget. This is a persistent attack: the malicious code remains on the published page until removed, affecting all subsequent visitors.

• CVE-2026-44913HIGH 7.2

  Apache NiFi versions 1.2.0 through 2.9.0 contain a SQL injection vulnerability in the CaptureChangeMySQL Processor. The flaw stems from inadequate escaping of database table names, allowing an authenticated attacker with high privileges to inject arbitrary SQL commands by supplying crafted table names. A partial mitigation added in version 1.8.0 introduced quoted boundaries but did not eliminate the risk entirely. Organizations using other NiFi processors are unaffected. Upgrading to version 2.10.0 resolves the issue through improved identifier escaping.

• CVE-2026-48209HIGH 7.1

  OTRS ticket management systems contain a reflected cross-site scripting (XSS) vulnerability in how they handle user input during ticket operations. An attacker can craft a malicious URL containing JavaScript code and trick an authenticated agent into clicking it. When opened, the script executes within the agent's browser session, potentially allowing the attacker to steal session tokens, modify tickets, or perform actions on behalf of that agent. The attack requires social engineering to deliver the link but does not require the attacker to have direct system access.

• CVE-2026-59895MEDIUM 6.1

  Hono, a JavaScript framework for building web applications, contains a flaw in its CSS class composition utility (cx() function) that fails to properly sanitize user-supplied class names during server-side rendering. When untrusted input is passed as a class attribute in JSX, an attacker can break out of the attribute context and inject arbitrary HTML markup into the rendered page. This occurs because the function marks its output as safe HTML without actually escaping the input strings. The vulnerability affects Hono versions 4.0.0 through 4.12.26 and has been patched in version 4.12.27.

• CVE-2026-44311MEDIUM 5.4

  Fabric.js, a popular JavaScript library for working with HTML5 canvas, contains a Cross-Site Scripting (XSS) vulnerability in versions before 7.4.0. The issue stems from improper handling of user input when converting gradient objects to SVG format. Specifically, when the toSVG() method processes color values in gradient color stops, it fails to escape special characters. If a web application takes the generated SVG string and inserts it into a webpage, an attacker can craft malicious input that executes arbitrary JavaScript in users' browsers. The vulnerability requires user interaction and affects the integrity and confidentiality of the browser session.

• CVE-2026-28898MEDIUM 5.3

  Swift-NIO-HTTP2, Apple's open-source networking library for HTTP/2 protocol handling, contains a validation gap in its HTTP/2-to-HTTP/1.1 converter. The library failed to check pseudo-header values (like :path, :authority, :scheme, :method, and :status) for control characters—specifically carriage return (CR), line feed (LF), and null (NUL) bytes—before translating HTTP/2 frames into HTTP/1.1 messages. An attacker could craft malicious HTTP/2 requests or responses containing these characters to bypass security controls or potentially inject unintended content into downstream systems that process the converted HTTP/1.1 messages. Version 1.44.1 and later reject such messages at the connection level.

• CVE-2026-49472MEDIUM 5.3

  FreeSWITCH versions prior to 1.11.0 contain a flaw in their embedded XML parsing library that can cause the application to stop responding to requests. The vulnerability stems from code that was copied from an older, unpatched version of libexpat and never received the security fix that libexpat itself received. An authenticated user with local or network access could trigger this denial-of-service condition, though the attack requires specific conditions to succeed.

• CVE-2026-54287MEDIUM 5.3

  Hono, a JavaScript web framework supporting multiple runtimes, has a flaw in how it handles HTTP cookies when deployed on AWS Lambda with either Application Load Balancer (ALB) or VPC Lattice v2. The framework incorrectly combines multiple Set-Cookie headers into a single comma-separated value. Since commas naturally appear in cookie attributes like expiration dates, clients cannot reliably parse them back into separate cookies, leading to silent data loss or misinterpretation. This affects cookie-based security controls and session management. The issue is resolved in version 4.12.25.

• CVE-2026-52846MEDIUM 4.2

  Caddy's stripHTML template function, designed to remove HTML tags from user input, has a flaw that allows certain malformed HTML patterns to bypass its filtering logic. Specifically, malformed tags like <<>img src=x onerror=alert()> can slip through, potentially leaving executable scripts in the output if that output is later rendered as HTML in a browser. This creates a client-side XSS vulnerability when applications use stripHTML to sanitize untrusted content but then display the result unsafely. The flaw affects Caddy versions prior to 2.11.4.

• CVE-2026-40011LOW 3.7

  CVE-2026-40011 is a low-severity vulnerability in which an attacker can send numerous crafted DNS queries to trigger the insertion of a malformed dynamic block. This results in invalid data being written to the Prometheus monitoring endpoint, causing the scraper to reject it until the block expires. The attack requires specific network conditions and does not enable data theft or system compromise, but does degrade visibility into system health during the attack window.

• CVE-2026-12047LOW 3.5

  pgAdmin 4's cloud deployment wizard contains an HTML injection vulnerability in its AWS, Azure, and Google Cloud credential-verification endpoints. When pgAdmin receives an error message from a cloud provider's API (such as a rejected AWS access key), it forwards that error text directly into the web interface without removing HTML tags. An authenticated attacker can craft a malicious credential submission containing HTML/iframe code; when the cloud provider rejects it and echoes back the attacker's input in its error message, pgAdmin displays that message in the wizard—parsing it as HTML. This allows the attacker to inject an iframe pointing to a malicious site, redirecting the victim's browser away from pgAdmin. The vulnerability requires the attacker to be an authenticated pgAdmin user and requires user interaction (submitting the malicious credential). Redirecting another user would require an additional cross-site request-forgery vector.