CLEANSTART-2026-OA04050 Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat

Security vulnerability affects the thingsboard package. Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat...

Improper Encoding or Escaping of Output

Overview org.webjars.npm:open is a cross platform package that opens stuff like URLs, files, executables. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the baseOpen function in index.js, which assembles a PowerShell Start-Process invocation by...

Security Bulletin: Multiple security vulnerabilities have been found in Containerized version of IBM Guardium Key Lifecycle Manager

Summary Multiple security vulnerabilities have been addressed in Containerized version of IBM Guardium Key Lifecycle Manager. Vulnerability Details CVEID:CVE-2026-34481 DESCRIPTION: Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versio...

Improper Encoding or Escaping of Output

Overview qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the stringify function when the allowEmptyArrays option is enabled. When an object key contains special...

Improper Encoding or Escaping of Output

Overview org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the stringify function when the allowEmptyArrays option is enabled. When an object key contains...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in fast-uri (CVE-2026-84292, CVE-2026-84394, CVE-2026-86472)

Summary IBM Db2 Developer Extension is affected by vulnerability in fast-uri CVE-2026-84292, CVE-2026-84394, CVE-2026-86472 Vulnerability Details CVEID:CVE-2026-84292 DESCRIPTION: fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo a...

Improper Encoding or Escaping of Output

Overview @apostrophecms/login-hcaptcha is an Adds hCaptcha to Apostrophe login pages Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via insufficient enforcement of hCaptcha verification in the login flow, allowing an authenticated low-privileged attack...

Improper Encoding or Escaping of Output

Overview @apostrophecms/form is a Build forms for ApostropheCMS in a simple user interface. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via insufficient enforcement of hCaptcha verification in the login flow, allowing an authenticated low-privileged...

Improper Encoding or Escaping of Output

Overview @apostrophecms/login-recaptcha is an Adds reCAPTCHA v3 to Apostrophe login pages Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via insufficient enforcement of hCaptcha verification in the login flow, allowing an authenticated low-privileged...

Security Bulletin: Automation Assets in IBM Integration is vulnerable to multiple vulnerabilities in fast-uri

Summary Automation Assets in IBM Integration is vulnerable to multiple vulnerabilities in fast-uri. CVE-2026-84292, CVE-2026-84394, CVE-2026-86472 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-84292 DESCRIPTION: fast-uri serializes the port component of a URI witho...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in fast-uri (CVE-2026-84292, CVE-2026-84394)

Summary IBM Db2 Developer Extension is affected by vulnerability in fast-uri CVE-2026-84292, CVE-2026-84394 Vulnerability Details CVEID:CVE-2026-84292 DESCRIPTION: fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host componen...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in RemoteSyslogAppender.AppendMessage, which drops every character outside the visible ASCII range and space that RFC 3164 permits, rather than representing it, so non-Latin text and control...

CVE-2026-105244

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whos...

CVE-2026-105244 Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whos...

Improper Encoding or Escaping of Output

Overview @vue/server-renderer is a @vue/server-renderer Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via isSSRSafeAttrName in packages/shared/src/domAttrConfig.ts, which fails to reject carriage return \r, U+000D characters in attribute names during...

Improper Encoding or Escaping of Output

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Improper Encoding or Escaping of Output

Overview satori is an Enlightened library to convert HTML and CSS to SVG. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the generation of its SVG output, which places certain input values into the document without neutralizing characters that are...

Improper Encoding or Escaping of Output

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the bundled domino dependency, which is used for server-side DOM emulation during Angular Universal rendering. An...

Improper Encoding or Escaping of Output

Overview xhtml-purifier is a Simple HTML purifier/cleaner for untrusted HTML. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the attributeString function in XHTMLPurifier.js, which writes attribute values into double-quoted HTML attributes without...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via pctDecChars, which decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. An attacker can craft percent-encoded payloads to bypass platform decoder validation and...