CVE-2026-63442

Prior to version 26.1.11 , OPNsense is vulnerable to a log forgery flaw due to the unauthenticated WebGUI login usernamefld accepting carriage-return and line-feed characters. These characters survive LOG_AUTH processing and are injected into the syslog-ng destination feeding the lockout_handler....

CVE-2026-63442 OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOGAUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding...

CVE-2026-63442 OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOGAUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding...

CVE-2026-41504 OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When...

CVE-2026-41504 OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When...

CVE-2026-41504

The OWASP Coraza WAF library (versions 3.0.0 through 3.7.0 ) is vulnerable to CRLF injection within its Native audit-log formatter. Specifically, the file internal/auditlog/formats.go fails to neutralize carriage returns ( ) and line feeds ( ) in attacker-influenced request/response bodies, heade...

CVE-2026-11939

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may be vulnerable to audit log forgery...

EUVD-2026-95283

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may be vulnerable to audit log forgery...

CVE-2026-11939

IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3) may be vulnerable to audit log forgery due to CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') . The impact includes a low integrity ...

CVE-2026-11939 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may be vulnerable to audit log forgery...

PT-2026-108221

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description These products are susceptible to audit log forgery, a condition where an attacker can inject fake entries into the...

Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields

Root Cause File: internal/auditlog/formats.go — multiple sites write attacker-influenced bytes into the Native audit-log stream without escaping \r or \n: go // Part B — request headers lines 72–80 for k, vv := range al.Transaction.Request.Headers for , v := range vv res.WriteByte'\n'...

GHSA-PRPW-WWV7-XJJR Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields

Root Cause File: internal/auditlog/formats.go — multiple sites write attacker-influenced bytes into the Native audit-log stream without escaping \r or \n: go // Part B — request headers lines 72–80 for k, vv := range al.Transaction.Request.Headers for , v := range vv res.WriteByte'\n'...

EUVD-2026-87123

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...

CVE-2026-84718

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...

EUVD-2026-85613

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...

CVE-2026-84718

A flaw exists in the Ansible Automation Platform automation-controller where the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying it originated from a trusted proxy. By selecting the leftmost (attacker-controlled) header value, an attacker ...

CVE-2026-84718: Use of Less Trusted Source

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...

PT-2026-97546

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description In the production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying if it...

BIT-ZOOKEEPER-2026-84501 Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...