CWE-75

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

3 CVEs Avg CVSS 8.6 MITRE
2
CRITICAL
0
HIGH
1
MEDIUM
0
LOW
2
POC
0
KEV

Monthly

CVE-2026-29042 CRITICAL POC PATCH Act Now

Shell command injection in Nuclio serverless framework before 1.15.20. PoC and patch available.

Command Injection AI / ML Nuclio
NVD GitHub
CVSS 3.1
9.8
EPSS
0.7%
CVE-2026-27120 MEDIUM POC PATCH This Month

Leafkit versions up to 1.4.1 contains a vulnerability that allows attackers to XSS if there is a leaf variable in the attribute that is user controlled (CVSS 6.1).

XSS Leafkit
NVD GitHub
CVSS 3.1
6.1
EPSS
0.0%
CVE-2025-50213 CRITICAL PATCH Act Now

Apache Airflow Providers Snowflake versions before 6.4.0 contain a Special Element Injection vulnerability (CWE-75) in the CopyFromExternalStageToSnowflakeOperator that fails to properly sanitize table and stage parameters, allowing unauthenticated attackers to execute arbitrary SQL injection attacks with complete system compromise (CVSS 9.8). This is a critical remote vulnerability requiring network access only, with no authentication or user interaction needed, making it a high-priority patch regardless of KEV/EPSS status.

Apache SQLi Python Apache Airflow Providers Snowflake
NVD GitHub
CVSS 3.1
9.8
EPSS
0.2%
CVE-2026-29042
EPSS 1% CVSS 9.8
CRITICAL POC PATCH Act Now

Shell command injection in Nuclio serverless framework before 1.15.20. PoC and patch available.

Command Injection AI / ML Nuclio
NVD GitHub
CVE-2026-27120
EPSS 0% CVSS 6.1
MEDIUM POC PATCH This Month

Leafkit versions up to 1.4.1 contains a vulnerability that allows attackers to XSS if there is a leaf variable in the attribute that is user controlled (CVSS 6.1).

XSS Leafkit
NVD GitHub
CVE-2025-50213
EPSS 0% CVSS 9.8
CRITICAL PATCH Act Now

Apache Airflow Providers Snowflake versions before 6.4.0 contain a Special Element Injection vulnerability (CWE-75) in the CopyFromExternalStageToSnowflakeOperator that fails to properly sanitize table and stage parameters, allowing unauthenticated attackers to execute arbitrary SQL injection attacks with complete system compromise (CVSS 9.8). This is a critical remote vulnerability requiring network access only, with no authentication or user interaction needed, making it a high-priority patch regardless of KEV/EPSS status.

Apache SQLi Python +1
NVD GitHub

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy