CWE-140
CWE-140 · 4 records · 2 with a public proof-of-concept
Records the NVD classes under CWE-140, highest CVSS first.
- HIGH 8.6CVE-2026-114713
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed …
- MEDIUM 5.3CVE-2026-104047public PoC
A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulati…
sssd · openshift container platform · enterprise linux
- MEDIUM 4.4CVE-2026-104040
A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exp…
- MEDIUM 4.2CVE-2026-124028public PoC
mistral.rs before 0.9.5 contains a delimiter injection vulnerability in mistralrs-core that allows attackers to inject tool calls by placing delimiter strings in text the model quotes. Attackers controlling documents, web pages or tool outputs can embed tags l…