CWE-1427 · 14 records
Improper Neutralization of Input Used for LLM Prompting
CVEs in this class
14 records
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
36Monitor | CVE-2026-78379No exploit | Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Toolsamazon · strands-agents-tools · CWE-1427 | Critical9.2 | — | 0.6% | Aug 25, 2026 |
34Monitor | CVE-2026-109440No exploit | LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCodeginlix-ai · langalpha · CWE-1427 | High8.7 | — | 0.6% | Oct 20, 2026 |
34Monitor | CVE-2026-114107No exploit | HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunToolhkuds · vibe-trading · CWE-1427 | High8.7 | — | 0.5% | Oct 21, 2026 |
34Monitor | CVE-2026-54142No exploit | OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approvaltinyhumansai · openhuman · CWE-1427 | High8.7 | — | 0.5% | 5 days ago |
34Monitor | CVE-2026-106020No exploit | Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Sjohnson controls · easyio neo io manager and tools installer · CWE-1427 | High8.6 | — | 0.1% | 5 days ago |
33Monitor | CVE-2026-54140No exploit | OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitizationtinyhumansai · openhuman · CWE-1427 | High8.3 | — | 0.5% | 5 days ago |
30Monitor | CVE-2026-18733No exploit | Prompt injection bypasses shell tool consent gate in Strands Agents Toolsaws · strands-agents-tools · CWE-1427 | High7.5 | — | 0.7% | Aug 3, 2026 |
25Monitor | CVE-2026-75130No exploit | Context7 2.1.2 Prompt Injection via Custom AI Instructionsuptash · context7 · CWE-1427 | Medium6.4 | — | 0.4% | Aug 18, 2026 |
23Monitor | CVE-2026-115415No exploit | Secret masking bypass in the environment tool in Strands Agents Toolsamazon · strands-agents-tools · CWE-1427 | Medium5.9 | — | 0.3% | Oct 28, 2026 |
22Monitor | CVE-2024-3303No exploit | Improper Neutralization of Input Used for LLM Prompting in GitLabgitlab · gitlab · CWE-1427 | Medium5.7 | — | 0.4% | Feb 13, 2025 |
21Monitor | CVE-2026-70331No exploit | Microsoft Edge for iOS Spoofing Vulnerabilitymicrosoft · edge · CWE-1427 | Medium5.4 | — | 0.4% | Aug 28, 2026 |
18Monitor | CVE-2025-36730No exploit | Windsurf Prompt Injection via Filenamewindsurf · windsurf · CWE-1427 | Medium4.6 | — | 0.1% | Oct 14, 2025 |
17Monitor | CVE-2026-21832No exploit | HCL AION is affected by multiple security vulnerabilities.hcl software · aion · CWE-1427 | Medium4.3 | — | 0.2% | Aug 13, 2026 |
8Monitor | CVE-2026-123498No exploit | Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadatago-vikunja · vikunja · CWE-1427 | Low2.1 | — | 0.1% | 3 days ago |
- CVE-2026-7837936Monitor
Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools
CriticalCVSS 9.2No exploitEPSS 0%amazon · strands-agents-toolsAug 25, 2026
- CVE-2026-10944034Monitor
LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode
HighCVSS 8.7No exploitEPSS 0%ginlix-ai · langalphaOct 20, 2026
- CVE-2026-11410734Monitor
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool
HighCVSS 8.7No exploitEPSS 0%hkuds · vibe-tradingOct 21, 2026
- CVE-2026-5414234Monitor
OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approval
HighCVSS 8.7No exploitEPSS 0%tinyhumansai · openhuman5 days ago
- CVE-2026-10602034Monitor
Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows S
HighCVSS 8.6No exploitEPSS 0%johnson controls · easyio neo io manager and tools installer5 days ago
- CVE-2026-5414033Monitor
OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitization
HighCVSS 8.3No exploitEPSS 0%tinyhumansai · openhuman5 days ago
- CVE-2026-1873330Monitor
Prompt injection bypasses shell tool consent gate in Strands Agents Tools
HighCVSS 7.5No exploitEPSS 0%aws · strands-agents-toolsAug 3, 2026
- CVE-2026-7513025Monitor
Context7 2.1.2 Prompt Injection via Custom AI Instructions
MediumCVSS 6.4No exploitEPSS 0%uptash · context7Aug 18, 2026
- CVE-2026-11541523Monitor
Secret masking bypass in the environment tool in Strands Agents Tools
MediumCVSS 5.9No exploitEPSS 0%amazon · strands-agents-toolsOct 28, 2026
- CVE-2024-330322Monitor
Improper Neutralization of Input Used for LLM Prompting in GitLab
MediumCVSS 5.7No exploitEPSS 0%gitlab · gitlabFeb 13, 2025
- CVE-2026-7033121Monitor
Microsoft Edge for iOS Spoofing Vulnerability
MediumCVSS 5.4No exploitEPSS 0%microsoft · edgeAug 28, 2026
- CVE-2025-3673018Monitor
Windsurf Prompt Injection via Filename
MediumCVSS 4.6No exploitEPSS 0%windsurf · windsurfOct 14, 2025
- CVE-2026-2183217Monitor
HCL AION is affected by multiple security vulnerabilities.
MediumCVSS 4.3No exploitEPSS 0%hcl software · aionAug 13, 2026
- CVE-2026-1234988Monitor
Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata
LowCVSS 2.1No exploitEPSS 0%go-vikunja · vikunja3 days ago