Advisories · Weakness
CWE-86.
Every Advisory and CVE whose sources give the weakness CWE-86, newest first.
- CVSS 6.9 Medium
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
- Cross-site scripting (XSS)
- CWE-86
>=2.7.0, <2.9.1 · fixed in 2.9.1
GHSA-f8fg-pg57-v4j8 · CVE-2026-86431 - CVSS 6.1 Medium
league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
- Cross-site scripting (XSS)
- CWE-86
>=1.5.0, <2.9.0 · fixed in 2.9.0
GHSA-29pj-957v-52mc · CVE-2026-71478 - CVSS 4.4 Medium
Vim has OS Command Injection in netrw
- vim
- CWE-86
- CVSS 2.1 Low
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
- Yokogawa Electric Corporation FAST/TOOLS
- CWE-86
- CVSS 5.4 Medium
Cisco Common Services Platform Collector Cross-Site Scripting Vulnerability
- Cisco Common Services Platform Collector Software
- CWE-86
- CVSS 5.4 Medium
Cisco Common Services Platform Collector Cross-Site Scripting Vulnerability
- Cisco Common Services Platform Collector Software
- CWE-86
- CVSS 5.4 Medium
Cisco Common Services Platform Collector Cross-Site Scripting Vulnerability
- Cisco Common Services Platform Collector Software
- CWE-86
- CVSS 4.3 Medium
Mozilla Firefox: A malicious website could have included an iframe with an malformed URI resulting in a…
- Mozilla Firefox
- CWE-86
- CVSS 7.2 High
Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller…: Improper neutralization in some Intel(R) Ethernet Adapters and Intel(R) Ethernet…
- Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware
- CWE-86
- CVSS 7.8 High
Intel(R) Arc(TM) & Iris(R) Xe Graphics software: Improper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before…
- Intel(R) Arc(TM) & Iris(R) Xe Graphics software
- CWE-86
- CWE-707
- CVSS 9.1 CriticalCritical · CVSS 9+
org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability
- Cross-site scripting (XSS)
- CWE-86
>=14.6-rc-1, <14.10.4 · fixed in 14.10.4
GHSA-663w-2xp3-5739 · CVE-2023-37908 - CVSS 3.3 Low
Intel(R) oneVPL GPU software: Improper neutralization in software for the Intel(R) oneVPL GPU software before version…
- Intel(R) oneVPL GPU software
- CWE-86
- CVSS 9.1 CriticalCritical · CVSS 9+
Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml
- Cross-site scripting (XSS)
- CWE-86
>=14.6-rc-1, <14.10.4 · fixed in 14.10.4
GHSA-pv7v-ph6g-3gxv · CVE-2023-31126