CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

i18next-http-backend incomplete URL validation permits SSRF

Duplicate Advisory: Prompt injection in Langflow Smart Transform can lead to code execution

Axios: Header Injection via Inherited headers After Minimal Interceptor

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

snipe-IT vulnerable to host header injection

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

Apache Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter

Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter

aiosmtplib: STARTTLS response injection

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

MeshCentral has unsanitized data fields

Flawfinder output manipulation via untrusted filenames and source text

GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

hashi-vault-js has a path traversal and query parameter injection

Logging operator has Fluentd configuration injection that allows remote code execution

swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

swagger-typescript-api vulnerable to code injection via unescaped enum string values

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

hermes-agent has an Injection issue

hermes-agent has an Injection issue