CVE-2026-85290 | Medium | 5.3 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur() method writes… |
CVE-2026-93421 | | | 2026-09-23 | Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-control… |
CVE-2026-6327 | Medium | 4.3 | 2026-09-23 | IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when writt… |
CVE-2026-11538 | Low | 3.7 | 2026-09-18 | IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies. |
CVE-2026-86522 | | | 2026-09-17 | Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by… |
CVE-2026-84501 | Medium | 5.3 | 2026-09-16 | An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request… |
CVE-2026-84439 | Medium | 5.3 | 2026-09-16 | When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sendi… |
CVE-2026-16189 | Medium | 4.8 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log. |
CVE-2026-16188 | Medium | 5.3 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log. |
CVE-2026-87859 | Medium | 5.3 | 2026-09-11 | morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, w… |
CVE-2026-14350 | Medium | 5.3 | 2026-09-04 | IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to improper neutralization… |
CVE-2026-9736 | Medium | 5.3 | 2026-09-03 | IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of speci… |
CVE-2026-15603 | Medium | 5.3 | 2026-08-28 | morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the… |
CVE-2026-81696 | Low | 3.3 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious… |
CVE-2026-81695 | Low | 3.3 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft enc… |
CVE-2026-81694 | Low | 3.3 | 2026-08-27 | openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before… |
CVE-2026-54511 | High | 8.6 | 2026-08-26 | LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue() function in packages/s… |
CVE-2026-44256 | Medium | 5.3 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py d… |
CVE-2026-74885 | Low | 3.6 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored mo… |
CVE-2026-17481 | High | 8.8 | 2026-08-13 | IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper output neutralization for logs. |
CVE-2026-18148 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content into Navigator log files due to improper output neutraliza… |
CVE-2026-48083 | Medium | 6.5 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `/api/log` endpoint acc… |
CVE-2026-62948 | Critical | 9.6 | 2026-07-15 | OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases… |
CVE-2026-12616 | | | 2026-06-29 | The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into thr… |
CVE-2026-10745 | | | 2026-06-24 | Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on Windows allows Log Injection-Tampering-Forging… |
CVE-2026-20260 | Medium | 4.3 | 2026-06-10 | In Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.5.0, an unauthenticated attacker could inject American National Standards In… |
CVE-2026-45565 | High | 8.1 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, EscapedString (app/modules/roxywi/class_m… |
CVE-2026-9016 | Medium | 5.3 | 2026-06-06 | The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Improper Output Neutralization for Logs in all versions u… |
CVE-2026-5078 | Medium | 5.3 | 2026-06-03 | Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stre… |
CVE-2026-45679 | Medium | 6.5 | 2026-06-02 | OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text… |
CVE-2026-6494 | Medium | 5.3 | 2026-04-17 | A flaw was found in the AAP MCP server. An unauthenticated remote attacker can exploit a log injection vulnerability by sending specially crafted input to the… |
CVE-2026-34478 | High | 7.5 | 2026-04-10 | Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to… |
CVE-2025-14684 | Medium | 4.0 | 2026-03-25 | IBM Maximo Application Suite - Monitor Component 9.1, 9.0, 8.11, and 8.10 could allow an unauthorized user to inject data into log messages due to improper neu… |
CVE-2026-24308 | High | 7.5 | 2026-03-07 | Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information s… |
CVE-2025-59784 | High | 7.2 | 2026-03-04 | 2N Access Commander version 3.4.1 and prior is vulnerable to log pollution. Certain parameters sent over API may be included in the logs without prior validati… |
CVE-2026-25548 | Critical | 9.1 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists… |
CVE-2025-12755 | Medium | 4.0 | 2026-02-17 | IBM MQ Operator (SC2 v3.2.0–3.8.1, LTS v2.0.0–2.0.29) and IBM‑supplied MQ Advanced container images (across affected SC2, CD, and LTS 9.3.x–9.4.x releases) con… |
CVE-2025-11537 | Medium | 5.0 | 2026-02-10 | A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive hea… |
CVE-2026-1337 | Medium | 5.4 | 2026-02-06 | Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs… |
CVE-2025-66577 | Medium | 5.3 | 2025-12-05 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to i… |
CVE-2025-20384 | Medium | 5.3 | 2025-12-03 | In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125… |
CVE-2025-36159 | Medium | 6.2 | 2025-11-20 | IBM Concert 1.0.0 through 2.0.0 could allow a local user to forge log files to impersonate other users or hide their identity due to improper neutralization of… |
CVE-2025-11627 | Medium | 6.5 | 2025-10-30 | The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log file poisoning in all versions up to, a… |
CVE-2025-36081 | Medium | 5.3 | 2025-10-28 | IBM Concert Software
1.0.0 through 2.0.0 could allow a user to modify system logs due to improper neutralization of log input. |
CVE-2025-57564 | High | 8.2 | 2025-10-07 | CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems via the /api/logs/insert/elasticsearch/_bu… |
CVE-2025-58580 | Medium | 6.5 | 2025-10-06 | An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can cr… |
CVE-2025-10217 | | | 2025-09-30 | A vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log data or to inject crafted data in logfile… |
CVE-2025-59476 | Medium | 5.3 | 2025-09-17 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messag… |
CVE-2025-54813 | High | 7.5 | 2025-08-22 | Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.
When using JSONLayout, not all payload bytes are properly escaped. If an attacker-sup… |
CVE-2025-54812 | Medium | 5.4 | 2025-08-22 | Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.
When using HTMLLayout, logger names are not properly escaped when writing out to the… |
CVE-2025-54389 | Medium | 6.2 | 2025-08-14 | AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker ca… |
CVE-2025-54656 | Medium | 6.5 | 2025-07-30 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts.
This issue affects Apache Struts Extras: before 2.
Wh… |
CVE-2025-49846 | | | 2025-07-03 | wire-ios is an iOS client for the Wire secure messaging application. From Wire iOS 3.111.1 to before 3.124.1, messages that were visible in the view port have… |
CVE-2025-48432 | Medium | 4.0 | 2025-06-05 | An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, whic… |
CVE-2024-13949 | Medium | 6.8 | 2025-05-22 | Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis i… |
CVE-2025-3942 | Medium | 4.3 | 2025-05-22 | Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linu… |
CVE-2025-41429 | Medium | 4.8 | 2025-05-19 | a-blog cms multiple versions neutralize logs improperly. If this vulnerability is exploited with CVE-2025-36560, a remote unauthenticated attacker may hijack a… |
CVE-2025-36625 | Medium | 4.3 | 2025-04-18 | In Nessus versions prior to 10.8.4, a non-authenticated attacker could alter Nessus logging entries by manipulating http requests to the application. |
CVE-2024-52962 | Medium | 5.3 | 2025-04-08 | An Improper Output Neutralization for Logs vulnerability [CWE-117] in FortiAnalyzer version 7.6.1 and below, version 7.4.5 and below, version 7.2.8 and below… |
CVE-2024-9606 | High | 7.5 | 2025-03-20 | In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key masking code onl… |
CVE-2024-12580 | Medium | 5.3 | 2025-03-20 | A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and file_id in the /… |
CVE-2025-25294 | Medium | 5.3 | 2025-03-06 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior t… |
CVE-2025-27111 | High | 7.5 | 2025-03-04 | Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can expl… |
CVE-2025-23405 | Medium | 5.3 | 2025-02-28 | Unauthenticated log effects metrics gathering incident response efforts and potentially exposes risk of injection attacks (ex log injection). |
CVE-2024-49355 | Medium | 5.3 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 may write improperly neutralized data to server log files when the tracing is enabled per the System Tracing feature. |
CVE-2025-25184 | Medium | 6.5 | 2025-02-12 | Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafti… |
CVE-2024-56473 | Medium | 5.3 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 could allow an attacker to spoof their IP address, which is written to log files, due to improper verification of '… |
CVE-2025-0754 | Medium | 4.3 | 2025-01-28 | The vulnerability was found in OpenShift Service Mesh 2.6.3 and 2.5.6. This issue occurs due to improper sanitization of HTTP headers by Envoy, particularly th… |
CVE-2024-35150 | Medium | 5.3 | 2025-01-25 | IBM Maximo Application Suite 8.10.12, 8.11.0, 9.0.1, and 9.1.0 - Monitor Component does not neutralize output that is written to logs, which could allow an att… |
CVE-2024-52891 | Medium | 5.4 | 2025-01-07 | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3
could allow an authenticated user to inject malicious information or obtain information from log… |
CVE-2024-7696 | Medium | 6.3 | 2025-01-07 | Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for an authenticated malicious client to tamper with audit log… |
CVE-2024-9026 | Low | 3.3 | 2024-10-08 | In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through cat… |
CVE-2024-47083 | High | 7.5 | 2024-09-25 | Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an issue in the Power Pl… |
CVE-2024-45808 | Medium | 6.5 | 2024-09-20 | Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unex… |
CVE-2024-8334 | Medium | 4.3 | 2024-08-30 | A vulnerability was found in master-nan Sweet-CMS up to 5f441e022b8876f07cde709c77b5be6d2f262e3f. It has been rated as problematic. This issue affects the func… |
CVE-2024-8297 | Medium | 5.3 | 2024-08-29 | A vulnerability was found in kitsada8621 Digital Library Management System 1.0. It has been classified as problematic. Affected is the function JwtRefreshAuth… |
CVE-2024-23194 | Low | 3.3 | 2024-07-11 | Improper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacker limited ability to modify Command Cent… |
CVE-2024-0095 | Critical | 9.0 | 2024-06-13 | NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where a user can inject forged logs and executable commands by injecting arbitrar… |
CVE-2024-31845 | Medium | 5.3 | 2024-05-21 | An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web applicatio… |
CVE-2023-28952 | Medium | 5.3 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to injection attacks in application logging by not sanitizing user provided data. IBM X-Force I… |
CVE-2023-39461 | Medium | 4.4 | 2024-05-03 | Triangle MicroWorks SCADA Data Gateway Event Log Improper Output Neutralization For Logs Arbitrary File Write Vulnerability. This vulnerability allows remote a… |
CVE-2024-25047 | High | 8.6 | 2024-05-02 | IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application logging by not sanitizing user provided… |
CVE-2023-6484 | Medium | 5.3 | 2024-04-25 | A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This iss… |
CVE-2024-1681 | Medium | 5.3 | 2024-04-19 | corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending… |
CVE-2024-32474 | High | 7.3 | 2024-04-18 | Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, th… |
CVE-2024-29022 | High | 8.8 | 2024-04-12 | Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request hea… |
CVE-2024-22356 | Medium | 4.9 | 2024-03-26 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.9.0 and IBM Integration Bus for z/OS 10.1 through 10.1.0.2store potentially sensit… |
CVE-2024-0690 | Medium | 5.0 | 2024-02-06 | An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still i… |
CVE-2023-38020 | Medium | 4.3 | 2024-02-02 | IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow an authenticated user to manipulate output written to log files. IBM X-Force ID: 260576. |
CVE-2024-0987 | Medium | 6.3 | 2024-01-29 | A vulnerability classified as critical has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected is an unknown function of the file /runtime/log… |
CVE-2024-22229 | Low | 3.1 | 2024-01-24 |
Dell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed by an authenticated attacker. An attacker could exploit this vu… |
CVE-2023-7234 | Medium | 5.3 | 2024-01-16 |
OPCUAServerToolkit will write a log message once an OPC UA client has successfully connected containing the client's self-defined description field.
|
CVE-2023-46713 | Medium | 5.3 | 2023-12-13 | An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may allow an attacker to… |
CVE-2023-6002 | Medium | 6.5 | 2023-11-08 | YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to for… |
CVE-2023-46322 | Critical | 9.8 | 2023-10-23 | iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's initial character may be non-alphanumeric. The host… |
CVE-2023-46321 | Critical | 9.8 | 2023-10-23 | iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell metacharacters for a /usr/bin/man command l… |
CVE-2023-4065 | Medium | 5.5 | 2023-09-27 | A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log. T… |
CVE-2023-4571 | High | 8.6 | 2023-08-30 | In Splunk IT Service Intelligence (ITSI) versions below below 4.13.3, 4.15.3, or 4.17.1, a malicious actor can inject American National Standards Institute (AN… |
CVE-2023-3997 | High | 8.6 | 2023-07-31 | Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk… |
CVE-2023-37275 | Low | 3.1 | 2023-07-13 | Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. The Auto-GPT command line UI makes heavy use of co… |