CVE-2026-54511 @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData...

CVE-2026-54511 @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData...

CVE-2026-54511 @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData...

EUVD-2026-66563

LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData...

CVE-2026-54511

@logtape/syslog (part of LogTape, a Node.js logging library) contains two related output-encoding bugs in its structured-data formatting, affecting versions prior to 1.3.11 , 2.0.14 , and 2.1.5 when includeStructuredData is set to true (non-default). The escapeStructuredDataValue() function fails...

FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can exploit this vulnerability to inject arbitrary headers or requests into an HTTP proxy CONNECT request. This occurs because FreeRDP does not properly validate control characters in the server-controlled...

Wazuh Server 4.4.0 < 4.14.6 Log Injection (CVE-2026-44256)

The version of Wazuh Server on the remote host is at least 4.4.0 and prior to 4.14.6. It is, therefore, affected by a log injection vulnerability: - The Basic authentication username is decoded before credential validation and passed to the access logger without neutralizing control characters. A...

CVE-2026-9254 Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices

An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute th...

EUVD-2026-65006

An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute th...

FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can exploit this vulnerability to inject arbitrary headers or requests into an HTTP proxy CONNECT request. This occurs because FreeRDP does not properly validate control characters in the server-controlled...

FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can exploit this vulnerability to inject arbitrary headers or requests into an HTTP proxy CONNECT request. This occurs because FreeRDP does not properly validate control characters in the server-controlled...

FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can exploit this vulnerability to inject arbitrary headers or requests into an HTTP proxy CONNECT request. This occurs because FreeRDP does not properly validate control characters in the server-controlled...

FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can exploit this vulnerability to inject arbitrary headers or requests into an HTTP proxy CONNECT request. This occurs because FreeRDP does not properly validate control characters in the server-controlled...

CVE-2026-8445

justhtml (a Python HTML parsing library) versions &lt;= 1.11.0 are vulnerable to a sanitizer bypass via its to_markdown() method. The root cause is insufficient escaping of HTML-significant characters (angle brackets ) in text nodes during Markdown conversion. While a small set of Markdown metach...

CVE-2026-8445: Improper Neutralization of Input During Web Page Generation

justhtml versions are preserved, so untrusted input that is safe in tohtml — including entity-decoded text e.g. or text from RCDATA/RAWTEXT-parsed elements like , , , and — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting when that...

SUSE CVE-2026-54770

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response.makelocationabsolute in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin strips leading C0 control characters and spaces. An attacker-controlled valu...

Linux Distros Unpatched Vulnerability : CVE-2026-43971

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in...

Linux Distros Unpatched Vulnerability : CVE-2026-54770

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response.makelocationabsolute in src/webob/response.py checks a Location value for a UR...

DEBIAN-CVE-2026-54770

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response.makelocationabsolute in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin strips leading C0 control characters and spaces. An attacker-controlled valu...

CVE-2026-54770

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response.makelocationabsolute in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin strips leading C0 control characters and spaces. An attacker-controlled valu...