CWE-943

CVEs per yearBy the year they were published

1. 20171
2. 20191
3. 20202
4. 20213
5. 20221
6. 20245
7. 20255
8. 2026134

Newest CVEs

• CVE-2026-123791

  OpenBMB Internet of Agents Agent Registry milvus_utils.py _primary_field_query data query logic injection

  OpenBMB · Internet of Agents

  Medium6.9
• CVE-2026-85726

  Chartbrew: Blind NoSQL injection via date variable in embedded chart

  chartbrew · chartbrew

  High7.5
• CVE-2026-123617

  Openwhyd before 1.65.1 NoSQL Injection via POST /api/user

  openwhyd · openwhyd

  Medium6.9
• CVE-2026-100365

  SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User

  SuiteCRM · SuiteCRM

  High8.8
• CVE-2026-63214

  SuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest api

  SuiteCRM · SuiteCRM

  High8.8
• CVE-2026-120567

  EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference

  MongoDB · Entity Framework Core Provider

  Low2.3
• CVE-2026-63489

  Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parameters

  yeti-platform · yeti

  High7.6
• CVE-2026-120201

  Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header

  dromara · Jpom

  Critical9.3
• CVE-2026-118645

  n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter

  n8n-io · n8n

  High7.0
• CVE-2026-118641

  n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes

  n8n-io · n8n

  Medium6.9

Vendors it comes up for most

1. MongoDB23
2. Splunk9
3. IBM7
4. n8n-io6
5. Cisco4
6. Spring4
7. TryGhost4
8. dgraph-io4
9. langchain-ai4
10. parse-community4