CWE-138 · 13 records

Improper Neutralization of Special Elements

CVEs in this class

13 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
41Plan	CVE-2023-42117No exploit	Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerabilityexim · exim · CWE-138 pre-auth RCE	Critical9.8	—	6.8%	May 2, 2024
39Monitor	CVE-2023-24531No exploit	Output of "go env" does not sanitize values in cmd/gogo toolchain · cmd/go · CWE-138 Pre-auth	Critical9.8	—	0.8%	Jul 2, 2024
36Monitor	CVE-2016-0750No exploit	The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events.infinispan · infinispan · CWE-138 RCE Deserialization	High8.8	—	2.4%	Sep 11, 2018
32Monitor	CVE-2022-2429No exploit	Ultimate SMS Notifications for WooCommerce <= 1.4.1 - CSV Injectionultimatesmsnotifications · ultimate sms notifications for woocommerce · CWE-138	High8.0	—	0.9%	Sep 6, 2022
31Monitor	CVE-2026-32178No exploit	.NET Spoofing Vulnerabilitymicrosoft · .net · CWE-138 Pre-auth	High7.5	—	2.1%	Apr 14, 2026
31Monitor	CVE-2024-38133No exploit	Windows Kernel Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1809 · CWE-138 Local privilege escalation	High7.8	—	0.7%	Aug 13, 2024
30Monitor	CVE-2026-26129No exploit	M365 Copilot Information Disclosure Vulnerabilitymicrosoft · 365 copilot chat · CWE-138 pre-auth RCE Command injection	High7.5	—	1.0%	May 7, 2026
30Monitor	CVE-2026-55841No exploit	Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original messagegraylog2 · graylog2-server · CWE-138 Pre-auth	High7.5	—	0.6%	Aug 28, 2026
30Monitor	CVE-2024-51500No exploit	Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmwaremeshtastic · meshtastic firmware · CWE-138 Pre-auth Denial of service	High7.5	—	0.4%	Nov 4, 2024
28Monitor	CVE-2022-0024No exploit	PAN-OS: Improper Neutralization Vulnerability Leads to Unintended Program Execution During Configuration Commitpaloaltonetworks · pan-os · CWE-138 RCE	High7.2	—	1.6%	May 11, 2022
21Monitor	CVE-2023-22288No exploit	Email HTML Injectioncheckmk · checkmk · CWE-138	Medium5.4	—	0.4%	Mar 20, 2023
21Monitor	CVE-2026-20009No exploit	Cisco Secure Firewall Adaptive Security Appliance SSH Partial Private Key Authentication Bypass Vulnerabilitycisco · adaptive security appliance software · CWE-138 Pre-auth Auth bypass	Medium5.3	—	0.4%	Mar 4, 2026
16Monitor	CVE-2025-48939No exploit	tarteaucitron.js vulnerable to DOM Clobbering via document.currentScriptamauri · tarteaucitronjs · CWE-138	Medium4.2	—	0.2%	Jul 3, 2025

CVE-2023-42117
41Plan
Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 7%
- pre-auth RCE
exim · eximMay 2, 2024
CVE-2023-24531
39Monitor
Output of "go env" does not sanitize values in cmd/go
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
go toolchain · cmd/goJul 2, 2024
CVE-2016-0750
36Monitor
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events.
HighCVSS 8.8No exploitEPSS 2%
- RCE
- Deserialization
infinispan · infinispanSep 11, 2018
CVE-2022-2429
32Monitor
Ultimate SMS Notifications for WooCommerce <= 1.4.1 - CSV Injection
HighCVSS 8.0No exploitEPSS 1%
ultimatesmsnotifications · ultimate sms notifications for woocommerceSep 6, 2022
CVE-2026-32178
31Monitor
.NET Spoofing Vulnerability
HighCVSS 7.5No exploitEPSS 2%
- Pre-auth
microsoft · .netApr 14, 2026
CVE-2024-38133
31Monitor
Windows Kernel Elevation of Privilege Vulnerability
HighCVSS 7.8No exploitEPSS 1%
- Local privilege escalation
microsoft · windows 10 1809Aug 13, 2024
CVE-2026-26129
30Monitor
M365 Copilot Information Disclosure Vulnerability
HighCVSS 7.5No exploitEPSS 1%
- pre-auth RCE
- Command injection
microsoft · 365 copilot chatMay 7, 2026
CVE-2026-55841
30Monitor
Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
graylog2 · graylog2-serverAug 28, 2026
CVE-2024-51500
30Monitor
Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
meshtastic · meshtastic firmwareNov 4, 2024
CVE-2022-0024
28Monitor
PAN-OS: Improper Neutralization Vulnerability Leads to Unintended Program Execution During Configuration Commit
HighCVSS 7.2No exploitEPSS 2%
- RCE
paloaltonetworks · pan-osMay 11, 2022
CVE-2023-22288
21Monitor
Email HTML Injection
MediumCVSS 5.4No exploitEPSS 0%
checkmk · checkmkMar 20, 2023
CVE-2026-20009
21Monitor
Cisco Secure Firewall Adaptive Security Appliance SSH Partial Private Key Authentication Bypass Vulnerability
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
cisco · adaptive security appliance softwareMar 4, 2026
CVE-2025-48939
16Monitor
tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript
MediumCVSS 4.2No exploitEPSS 0%
amauri · tarteaucitronjsJul 3, 2025

All vulnerability classes