CWE-150

CVEs per yearBy the year they were published

1. 20171
2. 20201
3. 20211
4. 20222
5. 20236
6. 20248
7. 202517
8. 202657

Newest CVEs

• CVE-2026-123847

  In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion

  JetBrains · IntelliJ IDEA

  Medium5.3
• CVE-2026-121547

  dysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata

  Canop · dysk

  Low1.0
• CVE-2026-54162

  Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI

  alexandre-daubois · ember

  Medium4.7
• CVE-2026-55467

  CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)

  OpenPrinting · cups

  Low2.5
• CVE-2026-81856

  Terminal escape sequence injection in Hex via unneutralized server-supplied output

  hexpm · hex

  Low2.3
• CVE-2026-105801

  openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

  openapi-generators · openapi-python-client

  High8.4
• CVE-2026-104026

  In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if…

  Meta Platforms, Inc · Sapling SCM

  High7.8
• CVE-2026-103431

  Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape sequences in data received from remote collectl instances

  collectl

  High7.7
• CVE-2026-102601

  Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

  thephpleague · flysystem

  Low3.5
• CVE-2026-100867

  spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection

  spaceship-prompt · spaceship-prompt

  Medium4.8

Vendors it comes up for most

1. RRWO4
2. Apache Software Foundation3
3. PEVANS3
4. git3
5. BINARY2
6. Canop2
7. Microsoft2
8. MongoDB Inc2
9. ash-project2
10. cli2