Common Weakness Enumeration

CWE-138 Improper Neutralization of Special Elements

Description

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-138 ordered by modification date.

3 reviewed records
Advisory ID NVD ID Severity PURLs Summary Last Modified
GHSA-gqr6-r77p-c2pj CVE-2026-55841 HIGH
maven/org.graylog2/graylog2-server

Fortigate syslog message parser can be exploited to modify or delete fields from the original message

 2026-08-28
GHSA-vmwf-m9c5-3jvc CVE-2026-32178 LOW
nuget/Microsoft.NetCore.App.Runtime.linux-arm nuget/Microsoft.NetCore.App.Runtime.linux-arm64 nuget/Microsoft.NetCore.App.Runtime.linux-musl-arm nuget/Microsoft.NetCore.App.Runtime.linux-musl-arm64 nuget/Microsoft.NetCore.App.Runtime.linux-musl-x64 nuget/Microsoft.NetCore.App.Runtime.linux-x64 nuget/Microsoft.NetCore.App.Runtime.osx-arm64 nuget/Microsoft.NetCore.App.Runtime.osx-x64 nuget/Microsoft.NetCore.App.Runtime.win-arm nuget/Microsoft.NetCore.App.Runtime.win-arm64 nuget/Microsoft.NetCore.App.Runtime.win-x64 nuget/Microsoft.NetCore.App.Runtime.win-x86

Microsoft Security Advisory CVE-2026-32178 – .NET Spoofing Vulnerability

2026-04-14
GHSA-q43x-79jr-cq98 CVE-2025-48939 MODERATE
npm/tarteaucitronjs

tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript

 2025-07-03