Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-1236
Weakness type CWE-1236 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 32 | 32 | 0 |
Monthly trend
▂▁▁▁▃▅▅██▅
2026-01 1 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 2 · 2026-06 4 · 2026-07 5 · 2026-08 8 · 2026-09 8 · 2026-10 4
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2020-36962 | 5.3 | 96.1 | — | Tendenci 12.3.1 - CSV/ Formula Injection |
| CVE-2026-47705 | 9.6 | 45.3 | — | TypeBot vulnerable to CSV injection in result export |
| CVE-2026-19501 | 8.8 | 45.2 | — | CVE-2026-19501 |
| CVE-2026-5242 | 8.8 | 42.8 | — | Code Injection in Mia Technologies' Pizzy Library |
| CVE-2026-18738 | 5.1 | 41.0 | — | Shlink CSV Formula Injection via Visit Export CLI |
| CVE-2026-55452 | 4.8 | 35.4 | — | Snipe-IT: CSV formula injection in Activity Report export |
| CVE-2026-14846 | 4.5 | 35.3 | — | Incorrect neutralisation in the PrestaShop firmware |
| CVE-2026-78209 | 8.4 | 33.7 | — | exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values |
| CVE-2026-86742 | 5.1 | 33.7 | — | Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report |
| CVE-2026-47693 | 6.9 | 29.9 | — | Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadshe… |
| CVE-2026-64955 | 6.1 | 28.7 | — | Velociraptor CSV Formula Injection in Export Pipeline |
| CVE-2026-79971 | 5.3 | 28.1 | — | — |
| CVE-2026-86745 | 5.1 | 28.0 | — | Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export |
| CVE-2026-76797 | 5.8 | 27.3 | — | MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Gener… |
| CVE-2026-54243 | 6.1 | 25.7 | — | Statamic: CSV formula injection in form submission exports |
| CVE-2026-41073 | 4.6 | 20.0 | — | RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and si… |
| CVE-2026-50179 | 4.2 | 19.7 | — | Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields |
| CVE-2026-86257 | 4.8 | 18.8 | — | wger before 2.6 CSV Formula Injection via member export |
| CVE-2026-65875 | 5.1 | 16.7 | — | — |
| CVE-2026-10248 | 2.0 | 15.0 | — | SourceCodester Pharmacy Sales and Inventory System Supplier Creation export create_supp… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| grokability | 3 |
| actualbudget | 2 |
| openclaw | 2 |
| baptistearno | 1 |
| basercms users community | 1 |
| bestpractical | 1 |
| dell | 1 |
| espocrm | 1 |
| exceljs | 1 |
| hcl | 1 |
| hitachi energy | 1 |
| mia technology | 1 |
| mongodb | 1 |
| openpanel-dev | 1 |
| otrs gmbh (former otrs ag) | 1 |
