CWE-138.

Fortigate syslog message parser can be exploited to modify or delete fields from the original message

• CWE-138

<6.3.12 || >=7.0.0, <7.0.7 || >=7.1.0, <7.1.2 · fixed in 6.3.12, 7.0.7, 7.1.2

M365 Copilot Information Disclosure Vulnerability

• Microsoft 365 Copilot's Business Chat
• CWE-138

Microsoft Security Advisory CVE-2026-32178 – .NET Spoofing Vulnerability

• CWE-138

>=8.0.0, <8.0.26 || >=9.0.0, <9.0.15 || >=10.0.0, <10.0.6 · fixed in 8.0.26, 9.0.15, 10.0.6

Cisco Secure Firewall Adaptive Security Appliance SSH Partial Private Key Authentication Bypass Vulnerability

• Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
• CWE-138

tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript

• CWE-138

<1.22.0 · fixed in 1.22.0

ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element

• esapi-java-legacy
• CWE-20
• CWE-138

Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware

• meshtastic firmware
• CWE-138
• CWE-159

Windows Kernel Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows Server 2019
• CWE-138

Improper input validation in Google Chrome

• Google Chrome
• CWE-20
• CWE-138

Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability

• Exim
• CWE-138

Email HTML Injection

• Tribe29 Checkmk
• CWE-138

Ultimate SMS Notifications for WooCommerce <= 1.4.1 - CSV Injection

• homescript Ultimate SMS Notifications for WooCommerce
• CWE-138

Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization

• Insecure deserialization
• CWE-138

<9.1.0.Final · fixed in 9.1.0.Final

PAN-OS: Improper Neutralization Vulnerability Leads to Unintended Program Execution During Configuration Commit

• Palo Alto Networks PAN-OS
• CWE-138