CWE-1236: CSV injection

CVEs per yearBy the year they were published

1. 201924
2. 202025
3. 202357
4. 202521
5. 202645
6. 202630
7. 202652
8. 202631
9. 202641

Newest CVEs

• CVE-2026-111038

  Multiple vulnerabilities in Coupa’s Total Spend Management Platform

  Coupa · Coupa Total Spend Management Platform

  High7.3
• CVE-2026-116648

  Tanium addressed an improper output sanitization vulnerability in Discover.

  Tanium · Discover

  Medium4.1
• CVE-2026-121433

  AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export

  AzuraCast · AzuraCast

  Medium5.1
• CVE-2026-67187

  Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields

  Saturday Drive · Ninja Forms

  Medium5.1
• CVE-2026-102799

  Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16

  icagenda.com · iCagenda extension for Joomla

  Medium5.3
• CVE-2026-116649

  Tanium addressed an improper output sanitization vulnerability in Enforce.

  Tanium · Enforce

  High7.1
• CVE-2026-116647

  Tanium addressed an improper output sanitization vulnerability in Comply.

  Tanium · Comply

  High7.1
• CVE-2026-86020

  Part-DB: Spreadsheet Formula Injection in XLSX Part Exports

  Part-DB · Part-DB-server

  Medium4.6
• CVE-2026-55154

  EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export

  espocrm · espocrm

  Medium5.4
• CVE-2026-109396

  Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports

  Thelia · Thelia

  Low2.3

Vendors it comes up for most

1. IBM19
2. Dell5
3. Fortinet5
4. Tanium3
5. grokability3
6. 1Panel-dev2
7. Axosoft2
8. Cisco2
9. Hikvision2
10. Lenovo2