CWE-943

CVEs per yearBy the year they were published

1. 20171
2. 20191
3. 20202
4. 20213
5. 20221
6. 20245
7. 20255
8. 2026129

Newest CVEs

• CVE-2026-120567

  EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference

  MongoDB · Entity Framework Core Provider

  Low2.3
• CVE-2026-63489

  Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parameters

  yeti-platform · yeti

  High7.6
• CVE-2026-120201

  Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header

  dromara · Jpom

  Critical9.3
• CVE-2026-118645

  n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter

  n8n-io · n8n

  High7.0
• CVE-2026-118641

  n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes

  n8n-io · n8n

  Medium6.9
• CVE-2026-118581

  NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol

  MongoDB · Java Driver

  Medium6.9
• CVE-2026-55369

  Waline login accepts a non-string email as a match-all MongoDB query

  walinejs · waline

  Medium6.5
• CVE-2026-116801

  Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query

  parse-community · parse-server

  Medium5.3
• CVE-2026-57193

  Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)

  asterisk · asterisk

  Medium6.9
• CVE-2026-55465

  Goobi viewer: Solr injection via unvalidated region parameter in spatial search

  intranda · goobi-viewer-core

  Medium5.3

Vendors it comes up for most

1. MongoDB23
2. Splunk9
3. IBM7
4. n8n-io6
5. Cisco4
6. Spring4
7. TryGhost4
8. dgraph-io4
9. langchain-ai4
10. parse-community4