PT-2026-61820

Name of the Vulnerable Software and Affected Versions Zyxel AX7501-B1 versions prior to 5.17ABPC.7.2C0 Description A post-authentication command injection issue exists within the syslog component. An authenticated attacker with administrator privileges can execute arbitrary operating system...

PT-2026-61931

OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm. Attackers with the read:rules role can access the GET /api/realm/syslog/event endpoint to retrieve operational logs from all tenant...

CVE-2026-39879

Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...

EUVD-2026-46031

Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...

CVE-2026-39879

Due to a missing sanitization call in ""afsqlddrunquery"" https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.cL219, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration,...

CVE-2026-39879

CVE-2026-39879 affects syslog-ng before version 4.12, where a missing sanitization in afsql_dd_run_query can allow SQL injection from an untrusted source when using the SQL destination driver (not enabled by default). The issue lies in the afsql.c component (afsql_dd_run_query) and is exploitable...

CVE-2026-39879 SQL injection in syslog-ng SQL destionation driver

Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...

CVE-2026-39879

Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...

CVE-2026-39879 SQL injection in syslog-ng SQL destionation driver

Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...

PT-2026-61651

Name of the Vulnerable Software and Affected Versions syslog-ng versions prior to 4.12 syslog-ng Premium Edition versions prior to 8.2 syslog-ng Store Box versions prior to 7.8 Description A SQL injection flaw exists when the SQL driver is manually configured, allowing an untrusted source to...

CVE-2026-39879: Improper Neutralization of Escape, Meta, or Control Sequences

Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...

Linux Distros Unpatched Vulnerability : CVE-2026-39879

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the...

Oracle Linux 10 : opencryptoki (ELSA-2026-28231)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-28231 advisory. 3.26.0-3.1 - Resolves: RHEL-171556, Fix possible out-of-bounds access in BER decode functions 3.26.0-3 - Resolves: RHEL-169565, Fix syslog message printing...

opencryptoki security update

3.26.0-3.1 - Resolves: RHEL-171556, Fix possible out-of-bounds access in BER decode functions 3.26.0-3 - Resolves: RHEL-169565, Fix syslog message printing about different CPs...

org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames

A flaw was found in Apache Log4j Core. This vulnerability allows for log injection through the use of Carriage Return Line Feed CRLF sequences. This occurs because security-related configuration attributes were silently renamed, impacting users who directly configure Rfc5424Layout with stream-bas...

CVE-2026-24698

An OS command injection vulnerability exists in the savesyslogtofile function of the "httpd" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The modelname configuration parameter is not properly sanitized, which could allow an authenticated...

CVE-2026-24698

Cisco RV130/RV130W routers (firmware 1.0.3.55 ) and RV110W routers (firmware 1.2.2.5 / 1.2.2.8 ) are vulnerable to an OS command injection vulnerability. The flaw exists within the save_syslog_to_file() function of the httpd binary due to improper sanitization of the model_name configuration para...

CVE-2026-24698

An OS command injection vulnerability exists in the savesyslogtofile function of the "httpd" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The modelname configuration parameter is not properly sanitized, which could allow an authenticated...

PT-2026-56462

An OS command injection vulnerability exists in the save syslog to file function of the "httpd" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The model name configuration parameter is not properly sanitized, which could allow an...

org.apache.camel.kafkaconnector:camel-netty-http-kafka-connector (>=4.14.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-netty-kafka-connector (>=4.14.0, <=4.14.5) +26 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-netty (>=4.14.0, <=4.14.7)

org.apache.camel:camel-netty MAVEN version =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.0, =4.14.5, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =3.27.4 and more Source cves: CVE-2026-42527https://vulners.com/cve/C...