CVE-2026-113870 is a vulnerability in MongoDB Compass where improper escaping of certain BSON values in stored views' aggregation pipelines can lead to arbitrary code execution. This occurs when a user opens a specially crafted view for editing, allowing code to run with the privileges of the Compass user. The issue affects versions from 1.7.0 up to but not including 1.49.15. A fix is available in version 1.49.15.
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.
A command injection vulnerability exists in the virtualenv tool for Python prior to version 21.14.4. The issue arises from improper escaping of environment names in the bash activate script, which zsh also sources. This allows an attacker to execute arbitrary commands in the user's shell prompt when using zsh with PROMPT_SUBST enabled. The vulnerability is fixed in version 21.14.4.
A command injection vulnerability exists in pypa virtualenv versions prior to 21.14.2. The issue arises because FishActivator inherits a quoting method that uses POSIX shlex.quote(), which is incompatible with the fish shell's interpretation of backslashes and single quotes. An attacker can craft environment variables such as the path, --prompt, or VIRTUALENV_PROMPT containing a backslash before a quote to break out of the fish literal and execute arbitrary commands when the user sources activate.fish. This vulnerability is fixed in version 21.14.2.
CVE-2026-113725 is an OS command injection vulnerability in the bash activate script of pypa virtualenv versions prior to 21.14.7. The vulnerability arises because the environment name used in the PS1 prompt is not properly escaped for both passes bash makes over PS1, allowing specially crafted environment names containing backslash and command substitution sequences to execute arbitrary commands in the user's shell. This affects users who source the activate script of an environment with an attacker-controlled name. The issue is fixed in version 21.14.7.
ApostropheCMS versions prior to 4.33.0 and certain versions of its CAPTCHA add-ons (Form, login-recaptcha, login-hcaptcha) improperly encode or escape user-supplied CAPTCHA response tokens. This flaw allows crafted tokens to inject request parameters, potentially disrupting CAPTCHA verification and related form or login flows. While automated probing for bypass is possible, no confirmed successful CAPTCHA bypass or secret disclosure has been established. The issue is fixed in Form 1.5.5, login-recaptcha 1.2.1, login-hcaptcha 1.3.0, and ApostropheCMS 4.33.0.
Vitest, a Vite-native testing framework for JavaScript and TypeScript, contains a code injection vulnerability in versions from 2.1.0-beta.7 up to but not including 4.1.12 and from 5.0.0 up to but not including 5.0.3. An unauthenticated non-browser WebSocket client can exploit this by registering a manual mock with an attacker-controlled URL that is inserted unescaped into generated module source. This leads to execution of attacker-controlled JavaScript on the development server origin when the developer's browser loads the module. The issue is fixed in versions 4.1.12 and 5.0.3.
fast-uri versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2 contain a vulnerability in the serialize(), normalize(), or resolve() functions when used with the non-default suffix reference option. This flaw allows the generation of a relative reference containing an unescaped colon in the first path segment, violating RFC 3986 and potentially causing the string to be interpreted as an absolute URI with a scheme. This can lead to cross-site scripting (XSS) vectors if the result is treated as a URI. The issue is fixed in versions 2.4.8, 3.1.9, and 4.2.3.
A cross-site scripting (XSS) vulnerability exists in mljar mercury versions 3.0.0 through 3.2.10. The vulnerability arises because mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML, allowing malicious HTML and event-handler attributes to execute in the browser when viewed by another user. This issue is fixed in version 3.2.11.
Text::CSV_XS versions before 1.65 for Perl contain a vulnerability where numeric fields with leading or trailing whitespace are not properly quoted when combined and printed. This improper encoding allows a numeric field containing newline characters to prematurely end a CSV record, causing subsequent fields to be interpreted as a new row.
Text::CSV_XS versions before 1.65 for Perl have a vulnerability where the end of a record and its line ending are dropped when a UTF-8 flagged field precedes invalid UTF-8 bytes during print operations. This causes the final bytes, closing quote, and line ending to be lost, resulting in subsequent records being concatenated onto the same line or misinterpreted as part of the previous field.
CVE-2026-18516 is a critical stored cross-site scripting (XSS) vulnerability in the Audit Logs component of Arcadia Technology, LLC's Crafty Controller. It allows a remote, unauthenticated attacker to inject malicious scripts via HTTP header injection due to improper output escaping. This vulnerability affects versions from 0 up to and including 4.10.8. The CVSS score is 9.6, indicating a high severity with potential for complete compromise of confidentiality, integrity, and availability.
CVE-2026-102235 is a high-severity vulnerability in Microsoft Visual Studio Code caused by improper encoding or escaping of output. This flaw allows an unauthorized attacker to execute code remotely over a network. The issue affects Visual Studio Code versions from 1.0.0 up to but not including 1.141.1. An official fix is available in version 1.141.1.
CVE-2026-104250 is a stored cross-site scripting (XSS) vulnerability in the unstructured library prior to version 0.24.1. When unstructured parses untrusted HTML documents and outputs them as HTML, it fails to escape malicious markup such as event handlers (e.g., onerror, onmouseover) and javascript: URLs. This allows embedded scripts to execute automatically in a viewer's browser when the output is rendered. The vulnerability affects the to_html() function and related HTML output paths. Exploitation can occur without user interaction, leading to information disclosure and potential privileged actions in ingestion pipelines where untrusted documents are reviewed in a web UI.
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.
A vulnerability in MariaDB server's view FRM parser allows improper encoding of newline characters in usernames. This flaw affects multiple MariaDB versions from 10.6.1 up to but excluding 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2. An attacker with CREATE USER and CREATE VIEW WITH GRANT OPTION privileges could craft a username that embeds additional view metadata, causing the parser to misinterpret it as security metadata and potentially escalate privileges. The issue is fixed in the stated fixed versions.
FreeScout versions prior to 1.8.235 contain a cross-site scripting (XSS) vulnerability when the APP_CLOUDFLARE_IS_USED setting is enabled. The application trusts the CF-Connecting-IP header during failed login attempts without validation and stores this value in the activity log. The LogsMonitor component inserts this unescaped value into administrator alert emails, allowing injected HTML to execute when the email is viewed. This vulnerability is fixed in version 1.8.235.
Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.
CVE-2026-105244 is a medium severity vulnerability in Apache log4net's RemoteSyslogAppender where improper encoding or escaping of output causes non-ASCII and control characters to be removed rather than escaped. This can cause distinct input values to appear identical in logs, potentially misleading log analysis. The issue affects versions from 1.2.12 up to but not including 3.5.0. Upgrading to version 3.5.0 resolves the vulnerability.
Quasar Framework versions prior to 3.3.0 contain a cross-site scripting (XSS) vulnerability due to improper neutralization of input during server-side rendering and static site generation. The vulnerability arises when the ssrContext.nonce value is interpolated directly into quoted HTML attributes without proper sanitization, allowing an attacker to inject malicious markup if they can control or override this value. This issue is fixed in version 3.3.0.