Skip to content
Noroxi

CWE-176 · 32 records

Improper Handling of Unicode Encoding

CVEs in this class

32 records

  • CVE-2024-43093
    59Plan

    In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensit

    HighCVSS 7.3KEVWeaponizedEPSS 1%

    google · androidNov 13, 2024

  • CVE-2024-24691
    40Plan

    Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation

    CriticalCVSS 9.8No exploitEPSS 2%

    zoom · meeting software development kitFeb 13, 2024

  • CVE-2023-39213
    39Monitor

    Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticate

    CriticalCVSS 9.8No exploitEPSS 1%

    zoom · virtual desktop infrastructureAug 8, 2023

  • CVE-2025-71316
    36Monitor

    SQLite sqldiff remote code execution via argument injection

    CriticalCVSS 9.2No exploitEPSS 0%

    sqlite · sqldiffJun 4, 2026

  • CVE-2026-93990
    34Monitor

    Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate

    HighCVSS 8.7No exploitEPSS 0%

    libexpat · libexpatSep 19, 2026

  • CVE-2026-4116
    28Monitor

    Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/C

    HighCVSS 7.2No exploitEPSS 1%

    sonicwall · sma6210 firmwareApr 9, 2026

  • CVE-2026-48618
    27Monitor

    A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypas

    MediumCVSS 6.5No exploitEPSS 3%

    nodejs · node.jsJun 25, 2026

  • CVE-2026-93751
    27Monitor

    uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars

    MediumCVSS 6.9No exploitEPSS 0%

    garycourt · uri-jsSep 18, 2026

  • CVE-2026-4114
    26Monitor

    Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP a

    MediumCVSS 6.6No exploitEPSS 1%

    sonicwall · sma6210 firmwareApr 9, 2026

  • CVE-2026-25480
    26Monitor

    FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)

    MediumCVSS 6.5No exploitEPSS 1%

    litestar · litestarFeb 9, 2026

  • CVE-2026-20202
    26Monitor

    Improper Input Validation during User Account Creation in Splunk Enterprise

    MediumCVSS 6.6No exploitEPSS 0%

    splunk · splunkApr 15, 2026

  • CVE-2026-59890
    24Monitor

    setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

    MediumCVSS 6.1No exploitEPSS 0%

    python · setuptoolsJul 8, 2026

  • CVE-2026-23950
    23Monitor

    node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

    MediumCVSS 5.9No exploitEPSS 0%

    isaacs · tarJan 19, 2026

  • CVE-2024-8067
    23Monitor

    Unicode "best fit" argument injection

    MediumCVSS 5.8No exploitEPSS 0%

    helix · helix coreSep 24, 2024

  • CVE-2023-31169
    22Monitor

    Improper Handling of Unicode Encoding

    MediumCVSS 5.7No exploitEPSS 0%

    selinc · sel-5030 acselerator quicksetAug 31, 2023

  • CVE-2026-14978
    22Monitor

    Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions

    MediumCVSS 5.5No exploitEPSS 0%

    hashicorp · go-slugAug 19, 2026

  • CVE-2026-35373
    22Monitor

    uutils coreutils ln Local Denial of Service via Improper Handling of Non-UTF-8 Filenames

    MediumCVSS 5.5No exploitEPSS 0%

    uutils · coreutilsApr 22, 2026

  • GHSA-392f-ggf5-fp3c
    22Monitor

    OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists

    MediumCVSS 5.5No exploit

    npm · openclawMar 2, 2026

  • CVE-2026-105241
    21Monitor

    Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch

    MediumCVSS 5.3No exploitEPSS 1%

    apache · log4netOct 6, 2026

  • CVE-2023-41889
    21Monitor

    Late-Unicode normalization vulnerability in SHIRASAGI

    MediumCVSS 5.3No exploitEPSS 1%

    ss-proj · shirasagiSep 15, 2023

  • CVE-2020-8929
    21Monitor

    Ciphertext integrity weakness in Tink

    MediumCVSS 5.3No exploitEPSS 0%

    google · tink javaOct 19, 2020

  • CVE-2026-44288
    21Monitor

    protobufjs: Overlong UTF-8 decoding

    MediumCVSS 5.3No exploitEPSS 0%

    protobufjs project · protobufjsMay 13, 2026

  • CVE-2025-59547
    21Monitor

    DNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscation

    MediumCVSS 5.3No exploitEPSS 0%

    dnnsoftware · dotnetnukeSep 23, 2025

  • CVE-2025-55129
    21Monitor

    HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonatio

    MediumCVSS 5.4No exploitEPSS 0%

    aquaplatform · revive adserverDec 1, 2025

  • CVE-2026-19954
    21Monitor

    Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names

    MediumCVSS 5.4No exploitEPSS 0%

    Oct 5, 2026

All vulnerability classes