CWE-1427

CVEs per yearBy the year they were published

1. 20256
2. 202620

Newest CVEs

• CVE-2026-106020

  Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order…

  Johnson Controls · EasyIO Neo IO Manager and Tools Installer

  High8.6
• CVE-2026-123653

  esengine DeepSeek-Reasonix doc.go discoverDocs llm prompting input

  esengine · DeepSeek-Reasonix

  Medium5.3
• CVE-2026-54142

  OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approval

  tinyhumansai · openhuman

  High8.7
• CVE-2026-54140

  OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitization

  tinyhumansai · openhuman

  High8.3
• CVE-2026-115415

  Secret masking bypass in the environment tool in Strands Agents Tools

  amazon · strands-agents-tools

  Medium5.9
• CVE-2026-114107

  HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool

  HKUDS · Vibe-Trading

  High8.7
• CVE-2026-109440

  LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode

  ginlix-ai · LangAlpha

  High8.7
• CVE-2026-77931

  MoviePilot 3.1.5 Command Injection via ExecuteCommandTool

  jxxghp · MoviePilot

  High8.7
• CVE-2026-96893

  Improper Neutralization of Input Used for LLM Prompting in GitLab

  GitLab · GitLab

  High7.3
• CVE-2026-70331

  Microsoft Edge for iOS Spoofing Vulnerability

  Microsoft · Microsoft Edge (Chromium-based)

  Medium5.4

Vendors it comes up for most

1. Salesforce4
2. GitLab3
3. Eclipse Foundation2
4. amazon2
5. tinyhumansai2
6. 1millionbot1
7. 611711Dark1
8. AWS1
9. HCL Software1
10. HKUDS1