CWE-116 Improper Encoding or Escaping of Output

swoosh has email-derived URL path injection in Microsoft Graph endpoint

Vitess vttablet /twopcz reflected XSS

unstructured: Stored XSS via unescaped HTML generation

Contao: Cross-site scripting in the comments bundle

PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

@vue/server-renderer: XSS via missing CR in attribute-name blacklist

Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

fast-uri vulnerable to authority injection via an unvalidated port in serialize

Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

ImageMagick: SVG-to-MVG Command Injection via coders/svg.c

Duplicate Advisory: ImageMagick: SVG-to-MVG Command Injection via coders/svg.c

xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

djust: A template binding inherits a context safety grant it never earned (XSS)

djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)

RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection

Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL

Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

SWC HTML minifier may allow script element breakout when minifying embedded JSON

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)