| Improper Encoding or Escaping of Output | |
| Resource Exhaustion | |
| HTTP Response Splitting | |
| Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | |
| Permissive Whitelist | |
| CVE-2026-3449 | |
| Allocation of Resources Without Limits or Throttling | |
| Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | |
| Out-of-bounds Write | |
| Improper Authentication | |
| Allocation of Resources Without Limits or Throttling | |
| Uncontrolled Recursion | |
| Cross-site Scripting (XSS) | |
| Buffer Overflow | |
| External Control of File Name or Path | |
| Improper Input Validation | |
| Improper Validation of Specified Quantity in Input | |
| XML Injection | |
| Cross-site Scripting (XSS) | |
| CVE-2026-8723 | |
| GHSA-r4q5-vmmm-2653 | |
| Directory Traversal | |
| CRLF Injection | |
| CVE-2026-2950 | |
| Algorithmic Complexity | |
| Server-Side Request Forgery (SSRF) | |
| Use of Uninitialized Resource | |
| Unintended Proxy or Intermediary ('Confused Deputy') | |
| Improperly Controlled Modification of Dynamically-Determined Object Attributes | |
| Incorrect Regular Expression | |
| Loop with Unreachable Exit Condition ('Infinite Loop') | |
| Server-Side Request Forgery (SSRF) | |
| Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') | |
| Directory Traversal | |
| Algorithmic Complexity | |
| Allocation of Resources Without Limits or Throttling | |
| CVE-2026-4800 | |
| Inefficient Regular Expression Complexity | |
| Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | |
| Arbitrary Code Injection | |
| CVE-2026-4867 | |
| Improper Verification of Cryptographic Signature | |
| Inefficient Regular Expression Complexity | |
| Improper Input Validation | |
| Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') | |
| Information Exposure | |
| Information Exposure | |
| Improper Input Validation | |
| Unintended Proxy or Intermediary ('Confused Deputy') | |
| Permissive Whitelist | |
| Resource Exhaustion | |
| Inefficient Regular Expression Complexity | |
| Improper Certificate Validation | |
| CVE-2026-12143 | |
| HTTP Response Splitting | |
| Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | |
