CWE-76: Improper Neutralization of Equivalent Special Elements

The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

14 tracked CVEs are classified under this weakness.

Highest-risk vulnerabilities

CVE-2024-34359 — llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata
CVE-2024-4897 — Remote Code Execution in parisneo/lollms-webui
CVE-2026-77180 — NGINX Ingress Controller vulnerability
CVE-2026-55723 — NGINX Ingress Controller vulnerability
CVE-2026-54722 — dssrf: there a critical security bug with remove_at_symbol_in_string
CVE-2026-11311 — NGINX Gateway Fabric vulnerability
CVE-2024-1882 — Server-side resource injection in PaperCut NG/MF
CVE-2026-66362 — NGF vulnerability
CVE-2024-1883 — Reflected XSS in PaperCut NG/MF
CVE-2024-1221 — Improper access controls on APIs on Linux and macOS in PaperCut NG/MF

CVE-2026-77180 — NGINX Ingress Controller vulnerability
CVE-2026-66362 — NGF vulnerability
CVE-2026-54722 — dssrf: there a critical security bug with remove_at_symbol_in_string
CVE-2026-55723 — NGINX Ingress Controller vulnerability
CVE-2026-11311 — NGINX Gateway Fabric vulnerability
CVE-2024-4897 — Remote Code Execution in parisneo/lollms-webui
CVE-2024-34359 — llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata
CVE-2024-1883 — Reflected XSS in PaperCut NG/MF
CVE-2024-1882 — Server-side resource injection in PaperCut NG/MF
CVE-2024-1221 — Improper access controls on APIs on Linux and macOS in PaperCut NG/MF