PT-2026-107375

Name of the Vulnerable Software and Affected Versions OWASP Coraza WAF versions 3.0.0 through 3.7.0 Description The Native audit-log formatter in internal/auditlog/formats.go fails to neutralize carriage returns r and line feeds when writing request and response fields. An attacker controlling th...

Astra Linux – Vulnerability in Apache2

Insufficient escaping of user-supplied data in modssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to log variables...

CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...

CVE-2026-96561

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.8.0 . The vulnerability stems from a chain of missing input neutralization and output escaping starting at the /mwai-ui/v1/chats/submit REST en...

CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...

PT-2026-105854

Summary The / csp endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using print without escaping control characters. A remote attacker can include ANSI/VT100 escape sequences in fields such as blocked-uri or document-uri. When the logs are viewed in ...

CVE-2026-47562

A flaw was found in the NVIDIA GPU Display Driver for Linux. The driver's kernel mode layer fails to properly sanitize user-supplied version strings, allowing a local user to inject crafted text into the kernel log. A successful exploit can lead to log data tampering and a Denial of Service DoS...

CVE-2026-47562

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the supplied version string is not properly sanitized. A successful exploit of this vulnerability might lead to denial of service and data...

EUVD-2026-90184

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the supplied version string is not properly sanitized. A successful exploit of this vulnerability might lead to denial of service and data...

CVE-2026-47562

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the supplied version string is not properly sanitized. A successful exploit of this vulnerability might lead to denial of service and data...

AlmaLinux 9.6 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1775739369)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1775739369 advisory. - Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication formerly...

Linux Distros Unpatched Vulnerability : CVE-2026-47562

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the...

CLEANSTART-2026-KR26174 unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",

Security vulnerability affects the apache-hive package. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble",...

NPM: morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

NPM: morgan vulnerable to Log Injection via unescaped double quote in quoted log fields vulnerability discovered by ? in WordPress Npm morgan versions 1.12.1...

morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

Impact Morgan writes attacker-controlled request data to the access log. Its escaping added in 1.11.0 and 1.12.0 neutralizes control characters, the Unicode line separators, and backslash, but not the double quote 0x22, which is the field delimiter of the Apache combined log format morgan emits. ...

EUVD-2026-76027

morgan vulnerable to Log Injection via unescaped double quote in quoted log fields...

GHSA-9F6G-J8CH-79G4 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

Impact Morgan writes attacker-controlled request data to the access log. Its escaping added in 1.11.0 and 1.12.0 neutralizes control characters, the Unicode line separators, and backslash, but not the double quote 0x22, which is the field delimiter of the Apache combined log format morgan emits. ...

CVE-2026-84501

A flaw was found in Apache ZooKeeper. An unauthenticated attacker can inject arbitrary fake log lines into the operational log by sending a specially crafted request containing newline characters. This vulnerability allows the attacker to forge complete log entries, including timestamps, log...

CVE-2026-85290

In versions prior to 1.7.2 , the InvoicePlane application is vulnerable to Log Injection due to unsanitized user input in the Cron::recur() method. The application fails to neutralize CRLF characters when writing an invalid cron_key from the URL path into the application log. An unauthenticated r...

CVE-2026-85290 InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can...