CWE-116: Improper encoding or escaping of output
602 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 4 of them as exploited in the wild.
- Published CVEs
- 602
- Last 12 months
- 265
- Critical
- 88
- Known exploited
- 4
Critical 88High 183Medium 274Low 54Not scored 3
CVEs per yearBy the year they were published
- 20131
- 20176
- 20187
- 201923
- 202020
- 202136
- 202261
- 202359
- 202462
- 202572
- 2026255
Known exploitedNewest addition to KEV first
- CVE-2026-20245
Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability
Cisco · Cisco Catalyst SD-WAN Controller
ExploitedHigh7.8 - CVE-2024-38475
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
Apache Software Foundation · Apache HTTP Server
ExploitedCritical9.1 - CVE-2022-42948
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely…
Product not named
ExploitedCritical9.8 - CVE-2022-24682
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in…
Product not named
ExploitedMedium6.1
Newest CVEs
- CVE-2026-123540
OpenAM before 16.1.4 Incomplete Attribute Encoding in SAML 1.x Form POST
OpenIdentityPlatform · OpenAM
Low2.0 - CVE-2026-103022
Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)
urwid · urwid
Medium5.3 - CVE-2026-102530
JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL
jupyterlab · jupyterlab-desktop
Critical9.4 - CVE-2026-102345
Zammad: Stored XSS in ticket article rendering in the new Vue-based interface
zammad · zammad
Medium5.1 - CVE-2026-120647
CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename
CGI
Not scored - CVE-2026-120644
CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values
CGI
Not scored - CVE-2026-63471
fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator
koxudaxi · fastapi-code-generator
Critical9.3 - CVE-2026-63469
fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict
koxudaxi · fastapi-code-generator
Critical9.3 - CVE-2026-63470
fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring
koxudaxi · fastapi-code-generator
Critical9.3 - CVE-2026-44266
Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels
enspirit · elo
Critical9.8