CVE-2026-44256 is a vulnerability in Wazuh versions from 4.4.0 up to but not including 4.14.6, and from 5.0.0-beta1 up to but not including 5.0.0-beta2. It involves improper output neutralization for logs (CWE-117) where the Basic authentication username is decoded and logged without sanitizing control characters. This allows an unauthenticated attacker to inject carriage returns or line feeds into the username, potentially forging log entries, obscuring activity, or poisoning systems that consume the plain-text audit log. The JSON log format is not affected. The issue is fixed in versions 4.14.6 and 5.0.0-beta2.
IBM Documentation Offline versions 1.0.0 through 1.4.1 contain a vulnerability due to improper output neutralization for logs (CWE-117). This flaw could allow a remote attacker to execute arbitrary code without requiring privileges or user interaction. The vulnerability has a high severity with a CVSS score of 8.8. No official patch or remediation guidance is currently provided by the vendor.
IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a vulnerability where a remote authenticated attacker could inject arbitrary content into Navigator log files due to improper output neutralization for logs. This issue is classified under CWE-117 and has a medium severity rating with a CVSS score of 4.3. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
OpenReception's appointment booking software prior to version 1.0.2 contains a vulnerability in its /api/log endpoint that allows unauthenticated attackers to inject arbitrary log entries. This endpoint accepts POST requests without authentication or schema validation and writes attacker-controlled content directly to application logs. This can lead to log injection, denial of service via log volume saturation, and oversized payload submissions. Version 1.0.2 addresses this issue.
The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into three log statements before any validation gate. Because the configured log format ("%(asctime)s - %(name)s - %(levelname)s - %(message)s") renders newlines literally, an unauthenticated attacker can forge log records that are byte-for-byte indistinguishable from PIA's genuine "Successfully authenticated project" message. PIA is an authentication broker whose logs are explicitly relied upon for incident response (DESIGN.md §5.4 lists "Token verifications" and "Errors" as events to log), so the ability to plant fake auth-success entries directly undermines the audit trail the service exists to produce.
Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on Windows allows Log Injection-Tampering-Forging.
This issue affects upKeeper Instant Privilege Access: through 1.6.1.
The Debug Log Manager plugin for WordPress up to version 2.5.0 is vulnerable to improper output neutralization for logs. This vulnerability allows unauthenticated attackers to inject forged entries into the WordPress debug log when the plugin's JavaScript error logging feature is enabled. The issue arises because the AJAX handler for logging errors is accessible without authentication and protected only by a nonce that is publicly exposed in the page HTML. This can lead to misleading log entries that obscure malicious activity.
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis systems. This issue has been patched in version 0.9.0.
Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.
Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:
* The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.
* The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.
Users of the SyslogAppender are not affected, as its configuration attributes were not modified.
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.
CVE-2025-14684 is a medium severity vulnerability in IBM Maximo Application Suite - Monitor Component versions 8.10, 8.11, 9.0, and 9.1. It involves improper output neutralization for logs (CWE-117), allowing an unauthorized user to inject data into log messages due to insufficient sanitization of special elements when writing to log files. This could lead to log injection or manipulation but does not impact confidentiality or availability. No known exploits are reported in the wild. There is no information about an available patch or official remediation from IBM at this time.
CVE-2026-4276 is a high-severity vulnerability in LibreChat RAG API version 0.7.0 that allows attackers to perform log injection by exploiting improper input validation. This flaw enables adversaries to forge or manipulate log entries, potentially obscuring malicious activities or injecting misleading information into logs. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. While it does not directly impact confidentiality or availability, it severely compromises the integrity of log data, which is critical for incident detection and forensic analysis. No known exploits are currently reported in the wild, and no patches have been released yet. Organizations relying on LibreChat RAG API 0.7.0 should prioritize monitoring and mitigation to prevent attackers from leveraging this vulnerability to cover their tracks or mislead security teams.
2N Access Commander version 3.4.1 and prior is vulnerable to log pollution. Certain parameters sent over API may be included in the logs without prior validation or sanitisation.
This vulnerability can only be exploited after authenticating with administrator privileges.
IBM MQ Operator (SC2 v3.2.0–3.8.1, LTS v2.0.0–2.0.29) and IBM‑supplied MQ Advanced container images (across affected SC2, CD, and LTS 9.3.x–9.4.x releases) contain a vulnerability where log messages are not properly neutralized before being written to log files. This flaw could allow an unauthorized user to inject malicious data into MQ log entries, potentially leading to misleading logs, log manipulation, or downstream log‑processing issues.
A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract these credentials (e.g., bearer tokens, session cookies) and use them to impersonate users, leading to a full account compromise.
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.
Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337
CVE-2025-66577 is a medium severity vulnerability in the cpp-httplib C++ HTTP/HTTPS library versions prior to 0.27.0. It involves improper output neutralization for logs (CWE-117), allowing attacker-controlled HTTP headers such as X-Forwarded-For or X-Real-IP to spoof client IP addresses in server logs. This can lead to log poisoning and audit evasion, potentially misleading administrators and security monitoring tools. The vulnerability does not impact confidentiality or availability but affects the integrity of log data. Exploitation requires no authentication or user interaction and can be performed remotely over the network. The issue is fixed in version 0.27.0.
IBM Concert 1.0.0 through 2.0.0 could allow a local user to forge log files to impersonate other users or hide their identity due to improper neutralization of output.
corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.
The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log file poisoning in all versions up to, and including, 1.47. This makes it possible for unauthenticated attackers to insert arbitrary content into log files, and potentially cause denial of service via disk space exhaustion.
When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.