Improper Output Neutralization for Logs

Overview morgan is a HTTP request logger middleware for node.js. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs in its format-token expansion, which does not neutralize the Unicode line separators U+0085 NEL, U+2028 LINE SEPARATOR, and U+2029 PARAGRAPH...

CVE-2026-81827

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

CVE-2026-81827 Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

CVE-2026-81827

Flowintel versions >=3.3.0 contained a validation flaw in the login flow: the code called Email(email) (which only constructs a WTForms validator object) instead of Email()(form, form.email), so malformed attacker-supplied email values bypassed validation. Because CR/LF characters in the email...

EUVD-2026-67133

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

CVE-2026-81827 Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

@logtape/syslog contains two related output-encoding bugs in the structured data formatting code. Both only affect deployments with includeStructuredData: true, which is non-default. 1. Unescaped C0 control characters in structured data values escapeStructuredDataValue in...

EUVD-2026-66563

LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData...

CVE-2026-54511

@logtape/syslog (part of LogTape, a Node.js logging library) contains two related output-encoding bugs in its structured-data formatting, affecting versions prior to 1.3.11 , 2.0.14 , and 2.1.5 when includeStructuredData is set to true (non-default). The escapeStructuredDataValue() function fails...

CVE-2026-54511 @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData...

PT-2026-82112

Name of the Vulnerable Software and Affected Versions @logtape/syslog versions prior to 1.3.11 @logtape/syslog versions prior to 2.0.14 @logtape/syslog versions prior to 2.1.5 Description Two output-encoding issues exist in the structured data formatting code when includeStructuredData is set to...

CVE-2026-59296

A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary...

Wazuh Server 4.4.0 < 4.14.6 Log Injection (CVE-2026-44256)

The version of Wazuh Server on the remote host is at least 4.4.0 and prior to 4.14.6. It is, therefore, affected by a log injection vulnerability: - The Basic authentication username is decoded before credential validation and passed to the access logger without neutralizing control characters. A...

GHSA-4PH6-MJV7-3FQ6 netfoil vulnerable to improper handling of untrusted DoH response data

Summary HTTPS RR data returned from the DoH server was not properly handled. Unverified APLN data which could contain arbitrary byte sequences was written directly to the log. It could also cause unnecessary memory usage. The single-byte response code was also written directly to the log...

Astra Linux – Vulnerability in Apache2

Insufficient escaping of user-supplied data in modssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to log variables...

CVE-2026-59296

CVE-2026-59296 affects io.micrometer:micrometer-registry-statsd and io.micrometer:micrometer-core , which do not sanitize newline characters (\n, \r) in metric names, tag keys, or tag values by default. When an application instruments meters using user-controlled, unvalidated input , an attacker ...

CVE-2026-59296 Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability

Using untrusted, non-normalized input as-is for metrics data such as metric names, tag keys, or tag values is a dangerous antipattern that general-purpose instrumentation should never perform. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16...

WordPress Download Monitor plugin < 5.2.6 - Unauthenticated Download Log Injection vulnerability

Unauthenticated Download Log Injection vulnerability discovered by Anirudh Gupta in WordPress Plugin Download Monitor versions 5.2.6...

CVE-2026-44256

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control...

CVE-2026-44256

Wazuh (open-source threat prevention, detection, and response platform) is vulnerable to CRLF log injection in its API access logger. In versions 4.4.0 through 4.14.6 and 5.0.0-beta2 , the file api/api/middlewares.py decodes the Basic-authentication username before credential validation and passe...