EUVD-2026-83276

IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies...

CVE-2026-11538

IBM WebSphere Application Server versions prior to 9.0.5.29 and 8.5.5.31 are affected by a log injection vulnerability. The root cause is the improper output neutralization of crafted LTPA token cookies , which can be exploited to inject malicious entries into logs. This issue also impacts Jazz f...

CVE-2026-11538 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies...

CVE-2026-11538 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies...

PT-2026-95600

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server 9.0 IBM WebSphere Application Server 8.5 Description Log injection is possible through the use of crafted LTPA Lightweight Third-Party Authentication token cookies. This allows an attacker to insert malicious...

CVE-2026-11538: Improper Output Neutralization for Logs

IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies...

UBUNTU-CVE-2026-86049

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...

Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve

A flaw was found in the JsonAccessLogValve component of Apache Tomcat. This improper encoding or escaping of output vulnerability could allow an attacker to inject specially crafted data into log files. This could lead to information disclosure or other unintended consequences when the logs are...

EEF-CVE-2026-86522 Log injection via an unescaped password reset identity in AshAuthentication

Summary Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...

CVE-2026-86522

AshAuthentication (team-alembic, Elixir/Phoenix) contains a log injection flaw in AshAuthentication.Strategy.Password.RequestPasswordReset.run/3. The identity argument—supplied directly from the password-reset request—is interpolated into Logger.warning/1 heredocs without escaping, truncating, or...

CVE-2026-86522 Log injection via an unescaped password reset identity in AshAuthentication

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...

EUVD-2026-81482

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...

CVE-2026-86522 Log injection via an unescaped password reset identity in AshAuthentication

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...

CVE-2026-86522 Log injection via an unescaped password reset identity in AshAuthentication

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...

Linux Distros Unpatched Vulnerability : CVE-2026-84501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauthensemble, ... request...

Linux Distros Unpatched Vulnerability : CVE-2026-84439

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending ...

CVE-2026-84439

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

DEBIAN-CVE-2026-84439

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

CVE-2026-84501

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...

DEBIAN-CVE-2026-84501

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...