938 matches found
CVE-2026-54511
@logtape/syslog (part of LogTape, a Node.js logging library) contains two related output-encoding bugs in its structured-data formatting, affecting versions prior to 1.3.11 , 2.0.14 , and 2.1.5 when includeStructuredData is set to true (non-default). The escapeStructuredDataValue() function fails...
CVE-2026-54511 @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys
LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData...
PT-2026-82112
Name of the Vulnerable Software and Affected Versions @logtape/syslog versions prior to 1.3.11 @logtape/syslog versions prior to 2.0.14 @logtape/syslog versions prior to 2.1.5 Description Two output-encoding issues exist in the structured data formatting code when includeStructuredData is set to...
CVE-2026-59296
A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary...
Wazuh Server 4.4.0 < 4.14.6 Log Injection (CVE-2026-44256)
The version of Wazuh Server on the remote host is at least 4.4.0 and prior to 4.14.6. It is, therefore, affected by a log injection vulnerability: - The Basic authentication username is decoded before credential validation and passed to the access logger without neutralizing control characters. A...
GHSA-4PH6-MJV7-3FQ6 netfoil vulnerable to improper handling of untrusted DoH response data
Summary HTTPS RR data returned from the DoH server was not properly handled. Unverified APLN data which could contain arbitrary byte sequences was written directly to the log. It could also cause unnecessary memory usage. The single-byte response code was also written directly to the log...
Astra Linux – Vulnerability in Apache2
Insufficient escaping of user-supplied data in modssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to log variables...
CVE-2026-59296
CVE-2026-59296 affects io.micrometer:micrometer-registry-statsd and io.micrometer:micrometer-core , which do not sanitize newline characters (\n, \r) in metric names, tag keys, or tag values by default. When an application instruments meters using user-controlled, unvalidated input , an attacker ...
CVE-2026-59296 Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability
Using untrusted, non-normalized input as-is for metrics data such as metric names, tag keys, or tag values is a dangerous antipattern that general-purpose instrumentation should never perform. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16...
WordPress Download Monitor plugin < 5.2.6 - Unauthenticated Download Log Injection vulnerability
Unauthenticated Download Log Injection vulnerability discovered by Anirudh Gupta in WordPress Plugin Download Monitor versions 5.2.6...
CVE-2026-44256
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control...
CVE-2026-44256
Wazuh (open-source threat prevention, detection, and response platform) is vulnerable to CRLF log injection in its API access logger. In versions 4.4.0 through 4.14.6 and 5.0.0-beta2 , the file api/api/middlewares.py decodes the Basic-authentication username before credential validation and passe...
CVE-2026-44256 Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control...
EUVD-2026-62575
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control...
CVE-2026-44256 Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control...
CRLF Injection
Apache CXF is vulnerable to CRLF Injection. The vulnerability is due to unsanitized clientId values from HTTP requests being directly included in OAuth2 server log messages, which allows an attacker to inject arbitrary content or forged log entries into server log files...
CVE-2026-64868 New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the...
CVE-2026-59911
Dell ObjectScale versions prior to 4.3.0.1 have an Insertion of Sensitive Information into Log File flaw in the svc_tools component. A low-privileged, locally authenticated attacker can read sensitive data written to logs, causing information disclosure (CVSS 5.5, medium). No exploitation details...
EUVD-2026-58667
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...