CWE-93

286 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

Critical 27High 77Medium 164Low 17Not scored 1

CVEs per yearBy the year they were published

CVE-2025-61884
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14.…
Oracle Corporation · Oracle Configurator
ExploitedHigh7.5

CVE-2026-109683
UPnP Newline Injection Vulnerability in TP-Link Archer BE805
TP-Link Systems Inc. · Archer BE805 v1
Medium5.3
CVE-2026-123298
In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible
JetBrains · Hub
Medium5.0
CVE-2026-123095
mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines
mpv-player · mpv
High7.7
CVE-2026-121946
zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders
zbateson · mail-mime-parser
Medium6.9
CVE-2026-57154
OPNsense: Configuration line injection via multiple GUI text fields
opnsense · core
High8.1
CVE-2026-121432
AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist
AzuraCast · AzuraCast
Medium5.1
CVE-2026-13575
HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI
http-session
Not scored
CVE-2026-119560
OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
opnsense · core
Medium6.0
CVE-2026-119424
OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity
opnsense · core
Medium6.1
CVE-2026-119417
CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport
cakephp · cakephp
Medium6.3