# CWE-86.

Every Advisory and CVE whose sources give the weakness CWE-86, newest first.

## Records, newest first

- [league/commonmark XSS: \`on\*\` event-handler filter in \`AttributesExtension\` bypassed with a U+000C form feed](https://agentprime.io/advisories/GHSA-f8fg-pg57-v4j8.md)
  `GHSA-f8fg-pg57-v4j8`, `CVE-2026-86431`, `PKSA-kr3s-894t-g5w2` · Packagist `league/commonmark`: affected `>=2.7.0, <2.9.1`, fixed in `2.9.1` · CVSS 6.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-86
- [league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes](https://agentprime.io/advisories/GHSA-29pj-957v-52mc.md)
  `GHSA-29pj-957v-52mc`, `CVE-2026-71478`, `PKSA-scnn-p8mm-jbft` · Packagist `league/commonmark`: affected `>=1.5.0, <2.9.0`, fixed in `2.9.0` · CVSS 6.1 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Cross-site scripting (XSS), CWE-86, CWE-692
- [Vim has OS Command Injection in netrw](https://agentprime.io/advisories/CVE-2026-28417.md)
  `CVE-2026-28417` · CVE record: vim vim · CVSS 4.4 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: CWE-86
- [A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.](https://agentprime.io/advisories/CVE-2025-66606.md)
  `CVE-2025-66606` · CVE record: Yokogawa Electric Corporation FAST/TOOLS · CVSS 2.1 Low · Not analysed yet · Published 9 Feb 2026 · Tags: CWE-86
- [Cisco Common Services Platform Collector Cross-Site Scripting Vulnerability](https://agentprime.io/advisories/CVE-2025-20168.md)
  `CVE-2025-20168` · CVE record: Cisco Cisco Common Services Platform Collector Software · CVSS 5.4 Medium · Not analysed yet · Published 8 Jan 2025 · Tags: CWE-86
- [Cisco Common Services Platform Collector Cross-Site Scripting Vulnerability](https://agentprime.io/advisories/CVE-2025-20167.md)
  `CVE-2025-20167` · CVE record: Cisco Cisco Common Services Platform Collector Software · CVSS 5.4 Medium · Not analysed yet · Published 8 Jan 2025 · Tags: CWE-86
- [Cisco Common Services Platform Collector Cross-Site Scripting Vulnerability](https://agentprime.io/advisories/CVE-2025-20166.md)
  `CVE-2025-20166` · CVE record: Cisco Cisco Common Services Platform Collector Software · CVSS 5.4 Medium · Not analysed yet · Published 8 Jan 2025 · Tags: CWE-86
- [Mozilla Firefox: A malicious website could have included an iframe with an malformed URI resulting in a…](https://agentprime.io/advisories/CVE-2024-10941.md)
  `CVE-2024-10941` · CVE record: Mozilla Firefox · CVSS 4.3 Medium · Not analysed yet · Published 6 Nov 2024 · Tags: CWE-86
- [Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller…: Improper neutralization in some Intel(R) Ethernet Adapters and Intel(R) Ethernet…](https://agentprime.io/advisories/CVE-2021-33158.md)
  `CVE-2021-33158` · CVE record: Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware · CVSS 7.2 High · Not analysed yet · Published 16 May 2024 · Tags: CWE-86
- [Intel(R) Arc(TM) & Iris(R) Xe Graphics software: Improper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before…](https://agentprime.io/advisories/CVE-2024-21864.md)
  `CVE-2024-21864` · CVE record: Intel(R) Arc(TM) & Iris(R) Xe Graphics software · CVSS 7.8 High · Not analysed yet · Published 16 May 2024 · Tags: CWE-86, CWE-707
- [org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability](https://agentprime.io/advisories/GHSA-663w-2xp3-5739.md)
  `GHSA-663w-2xp3-5739`, `CVE-2023-37908` · Maven `org.xwiki.rendering:xwiki-rendering-xml`: affected `>=14.6-rc-1, <14.10.4`, fixed in `14.10.4` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2023 · Tags: Cross-site scripting (XSS), CWE-86
- [Intel(R) oneVPL GPU software: Improper neutralization in software for the Intel(R) oneVPL GPU software before version…](https://agentprime.io/advisories/CVE-2023-22840.md)
  `CVE-2023-22840` · CVE record: Intel(R) oneVPL GPU software · CVSS 3.3 Low · Not analysed yet · Published 11 Aug 2023 · Tags: CWE-86
- [Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml](https://agentprime.io/advisories/GHSA-pv7v-ph6g-3gxv.md)
  `GHSA-pv7v-ph6g-3gxv`, `CVE-2023-31126` · Maven `org.xwiki.commons:xwiki-commons-xml`: affected `>=14.6-rc-1, <14.10.4`, fixed in `14.10.4` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 May 2023 · Tags: Cross-site scripting (XSS), CWE-86

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-86>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-86/>. Everything for agents: <https://agentprime.io/llms.txt>.