Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments uses Apache Log4j version that is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes ( CVE-2026-34478)

Summary IBM Storage Protect Data Protection for Virtual Environments uses Apache Log4j version that is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. This issue has been fixed in this release by incorporating the Apache...

ROOT-APP-MAVEN-CVE-2026-34478 CVE-2026-34478 in io.root.org.apache.logging.log4j:log4j-core - Patched by Root

Root has patched CVE-2026-34478 in the io.root.org.apache.logging.log4j:log4j-core package for Root:Maven. Multiple fixed versions available...

CLEANSTART-2026-SD03557 Security fixes in elasticsearch 9.2.8-r2

Package elasticsearch version 9.2.8-r2 fixes 6 vulnerabilities: CVE-2025-68161, CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, CVE-2026-34479...

CLEANSTART-2026-QU19901 Security fixes in kafka 4.1.2-r0

Package kafka version 4.1.2-r0 fixes 10 vulnerabilities: CVE-2026-34477, ghsa-6hg6-v5c8-fphq, CVE-2026-34478, ghsa-445c-vh5m-36rj, CVE-2026-34479...

CLEANSTART-2026-FE38987 Security fixes in schema-registry 8.1.2-r0

Package schema-registry version 8.1.2-r0 fixes 5 vulnerabilities: CVE-2025-12383, CVE-2026-34477, CVE-2026-34478, CVE-2026-34479, CVE-2026-34480...

CLEANSTART-2026-CQ01177 Security fixes for CVE-2024-38828, CVE-2024-6763, CVE-2025-11143, CVE-2026-2332, CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, CVE-2026-49268, ghsa-3pxv-7cmr-fjr4, ghsa-445c-vh5m-36rj, ghsa-6hg6-v5c8-fphq, ghsa-72hv-8253-57qq, ghsa-qh8g-58pp-2wxh, ghsa-w3c8-7r8f-9jp8, ghsa-x96m-rh44-vgv8 applied in versions: 5.19.3-r0, 5.19.3-r1, 6.2.6-r0

Multiple security vulnerabilities affect the activemq package. These issues are resolved in later releases. See references for individual vulnerability details...

Security Bulletin: There is a vulnerability in log4j-core-2.25.3.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-34477, CVE-2026-34478, CVE-2026-34480)

Summary There is a vulnerability in log4j-core-2.25.3.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed...

Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Apache Log4j and Bouncy Castle.

Summary IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Apache Log4j and Bouncy Castle. Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostnam...

Apache Log4j 2.21.0 < 2.25.4 Rfc5424Layout Log Injection (CVE-2026-34478)

The version of Apache Log4j on the remote host is 2.21.0 through 2.25.3. It is, therefore, affected by a vulnerability: - The Rfc5424Layout is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. The newLineEscape attribute was...

ch.cern:cerndb-sw-zkpolicy (=1.0.1-21), cloud.metaapi.sdk:metaapi-common-java (>=1.0.0 <=1.0.1) +258 more potentially affected by CVE-2026-34478 via org.apache.logging.log4j:log4j-core (>=3.0.0-beta1 <=3.0.0-beta3)

org.apache.logging.log4j:log4j-core MAVEN version =3.0.0-beta1, =1.0.0, =0.0.2, =00.00.03, =1.0.6, =1.0.7, =1.0.0, =2.0.21, =1.0, =1.0.2 - com.frostphyr:customappender =1.1.0 and more Source cves: CVE-2026-34478 Source advisory: SNYK:JAVA-ORGAPACHELOGGINGLOG4J-15967739...

CVE-2026-34478

creationtimestamp| type| source ---|---|--- 2026-04-10 16:05:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mj5p7rwcg32m 2026-04-24 19:22:23+00:00| seen| Telegram/VmN8f5p2u92gs4jEsEEqNusAAFK4tqyRCmSO0VkIRHhWQI 2026-04-24 19:22:45+00:00| seen|...