CLEANSTART-2026-ZT93395 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

CVE-2026-56864 affects multiple packages. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

CLEANSTART-2026-ZA11117 unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",

CVE-2026-84501 affects multiple packages. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble",. See references for individual vulnerability details...

PT-2026-107824

A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. The vulnerability could allow an authenticated attacker with access to the log file including the SANnav supportsave to access the passwords...

CVE-2026-76267

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could inject forged entries into the app log through the Representational State Transfer REST API. The vulnerability is possible because Splunk App for Splunk O11y Cloud...

CVE-2026-76267

In Splunk Enterprise versions below 10.4.3 , 10.2.7 , and 10.0.10 , a log injection vulnerability exists within the Splunk App for Splunk O11y Cloud . An attacker with the read_o11y_content capability can inject forged entries into the application log via the REST API . This occurs because the ap...

EUVD-2026-94619

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could inject forged entries into the app log through the Representational State Transfer REST API. The vulnerability is possible because Splunk App for Splunk O11y Cloud...

CVE-2026-76267 Log Injection through the REST API in Splunk App for Splunk O11y Cloud

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could inject forged entries into the app log through the Representational State Transfer REST API. The vulnerability is possible because Splunk App for Splunk O11y Cloud...

CVE-2026-103371

Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue...

EUVD-2026-94553

Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue...

CVE-2026-103371

Apache Geode versions 2.0.0 through 2.0.3 are affected by a vulnerability where the Management REST API improperly inserts sensitive information into log files. This issue, identified as CWE-532 , could lead to the exposure of confidential data through system logs. To mitigate this risk, users ar...

Security Bulletin:morgan HTTP Request Logger Middleware: Unicode Line Separator Log Forge Vulnerability

Summary morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remo...

Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in Apache Log4j

Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in Apache Log4j. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during...

CVE-2025-67223

CVE-2025-67223: Incorrect Access Control & Information Disclosure in Aranda Service Desk CVE ID: CVE-2025-67223 Affected Product: Aranda Service Desk Aranda File Server - AFS module Affected Versions: 8.3.12 Author: Brandon Perez Lara 🚨 Overview A critical vulnerability was identified in the file...

CVE-2025-70519

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

CVE-2025-70515

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

CVE-2019-19547

CVE-2019-19547 CVE-2019-19547 POC Symantec EDR on-prem version prior to "4.3.0" is vulnerable to an unauthenticated reflected XSS via the following URL: https://@IPEDR/r3epmpi/v1/dx/log Reference...

CVE-2024-43363

CVE-2024-43363 CVE-2024-43363 Exploit Script This Python script is designed to test if a Cacti instance is vulnerable to CVE-2024-43363, a Remote Code Execution RCE vulnerability caused by log poisoning. How the Vulnerability Works: Log Poisoning: An attacker injects PHP code into device names,...

CVE-2025-20384

SPLUNK CVE-2025-20384 i dunno, i just read stuff my friendo sent to me and start typing down some random sorry ass nub javascript code Log Injection/Forgery/Poisoning/Obfuscate type POC Please read this arcticle OWASP Log Injection TL;DR Look for static file, passed it and append some random...

CVE-2026-105244

A flaw was found in the RemoteSyslogAppender component of log4net. Non-standard and invisible characters in log messages are stripped rather than safely escaped. An attacker who can supply data that is written to logs can exploit this behavior to falsify or obfuscate log entries, potentially maki...

CVE-2026-105242

A flaw was found in log4net. A remote attacker can exploit this issue by sending a crafted request containing content such as markup that triggers ASP.NET request validation. When log4net attempts to parse the request parameters, an unhandled exception occurs, causing the logging system to discar...