CVE-2026-93421: Improper Output Neutralization for Logs

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...

CVE-2026-6327: Improper Output Neutralization for Logs

IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...

io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing

A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary...

BIT-ZOOKEEPER-2026-84439 Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

PT-2026-95847

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add auth"ensemble", ... request containing newline characters . When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...

PT-2026-95846

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters t embedded in the username. Because the audit log uses tab-separated key=value format...

CVE-2026-11538

IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies...

EUVD-2026-83276

IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies...

CVE-2026-11538 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies...

CVE-2026-11538

IBM WebSphere Application Server versions prior to 9.0.5.29 and 8.5.5.31 are affected by a log injection vulnerability. The root cause is the improper output neutralization of crafted LTPA token cookies , which can be exploited to inject malicious entries into logs. This issue also impacts Jazz f...

CVE-2026-11538 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies...

CVE-2026-11538: Improper Output Neutralization for Logs

IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies...

PT-2026-95600

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server 9.0 IBM WebSphere Application Server 8.5 Description Log injection is possible through the use of crafted LTPA Lightweight Third-Party Authentication token cookies. This allows an attacker to insert malicious...

UBUNTU-CVE-2026-86049

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...

Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve

A flaw was found in the JsonAccessLogValve component of Apache Tomcat. This improper encoding or escaping of output vulnerability could allow an attacker to inject specially crafted data into log files. This could lead to information disclosure or other unintended consequences when the logs are...

CVE-2026-86522

AshAuthentication (team-alembic, Elixir/Phoenix) contains a log injection flaw in AshAuthentication.Strategy.Password.RequestPasswordReset.run/3. The identity argument—supplied directly from the password-reset request—is interpolated into Logger.warning/1 heredocs without escaping, truncating, or...

CVE-2026-86522 Log injection via an unescaped password reset identity in AshAuthentication

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...

CVE-2026-86522 Log injection via an unescaped password reset identity in AshAuthentication

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...

EEF-CVE-2026-86522 Log injection via an unescaped password reset identity in AshAuthentication

Summary Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...

EUVD-2026-81482

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...