CVE-2026-1337

CVE-2026-1337 - Neo4j - Log Injection Log injection by an authenticated user is possible in the Neo4j query.log when Neo4j is not configured to be in json format. Summary Neo4j does not escape control characters in the metadata field when of a bolt transaction. An autenticated user could send...

CVE-2021-42574

Trojan Source:Invisible Vulnerabilities - Code generator — In simple terms, the vulnerability is that the code looks different from what it will be when compiled : The attack consists of using embedded control characters in comments and strings to reorder source code characters in a way that...

CVE-2026-69211

Http4s is a Scala library for HTTP services. Prior to 0.23.35 and 1.0.0-M47 , the ResponseCookie.render method writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from u...

CVE-2026-91986

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

unicode-control-characters-action

Unicode Control Characters Action A GitHub Action to find Unicode control characters using the Red Hat diagnostic tool https://access.redhat.com/security/vulnerabilities/RHSB-2021-007 to detect RHSB-2021-007 Trojan source attacks CVE-2021-42574,CVE-2021-42694 Inputs args Required The script...

CVE-2026-84370 SVGO: removeScripts allows executable links through namespace and control-character bypasses

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

CVE-2026-84370

SVGO (SVG Optimizer), a popular Node.js library for optimizing SVG files, contains a flaw in its opt-in removeScripts plugin (named removeScriptElement in v2/v3) that allows executable links to bypass filtering. The root cause involves two bypass vectors: the plugin fails to recognize namespace-p...

FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can exploit this vulnerability to inject arbitrary headers or requests into an HTTP proxy CONNECT request. This occurs because FreeRDP does not properly validate control characters in the server-controlled...

FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can exploit this vulnerability to inject arbitrary headers or requests into an HTTP proxy CONNECT request. This occurs because FreeRDP does not properly validate control characters in the server-controlled...

GHSA-6HX8-3WJJ-GR8G WebOb: Open redirect in Location header normalization via leading C0 control / space characters

Summary This is a third follow-up to CVE-2024-42353 / GHSA-mg3v-6m49-jhp3 and CVE-2026-44889 / GHSA-fh3h-vg37-cc95. WebOb makes the Location header absolute when it serves a redirect. To stop a relative or protocol-relative target from redirecting users off-host, it checks the value for a URI...

EUVD-2026-67050

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...

CVE-2026-81685 openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata

opensslencrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bi...

CVE-2026-54770

A flaw was found in WebOb, a library for HTTP requests and responses. This vulnerability allows an unauthenticated attacker to bypass URL validation checks by injecting leading control characters or spaces into a redirect target. This can lead to an open redirect, enabling attackers to send users...

@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

@logtape/syslog contains two related output-encoding bugs in the structured data formatting code. Both only affect deployments with includeStructuredData: true, which is non-default. 1. Unescaped C0 control characters in structured data values escapeStructuredDataValue in...

GHSA-8H6H-X5PQ-56FQ @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

@logtape/syslog contains two related output-encoding bugs in the structured data formatting code. Both only affect deployments with includeStructuredData: true, which is non-default. 1. Unescaped C0 control characters in structured data values escapeStructuredDataValue in...

EUVD-2026-66563

LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData...

CVE-2026-54511

@logtape/syslog (part of LogTape, a Node.js logging library) contains two related output-encoding bugs in its structured-data formatting, affecting versions prior to 1.3.11 , 2.0.14 , and 2.1.5 when includeStructuredData is set to true (non-default). The escapeStructuredDataValue() function fails...

CVE-2026-54511 @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData...

FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can exploit this vulnerability to inject arbitrary headers or requests into an HTTP proxy CONNECT request. This occurs because FreeRDP does not properly validate control characters in the server-controlled...

Wazuh Server 4.4.0 < 4.14.6 Log Injection (CVE-2026-44256)

The version of Wazuh Server on the remote host is at least 4.4.0 and prior to 4.14.6. It is, therefore, affected by a log injection vulnerability: - The Basic authentication username is decoded before credential validation and passed to the access logger without neutralizing control characters. A...