CWE-117

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN opt

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Co

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper ou

LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStruc

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, Es

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an att

Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions

2N Access Commander version 3.4.1 and prior is vulnerable to log pollution. Certain parameters sent over API may be incl

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can

A flaw was found in the AAP MCP server. An unauthenticated remote attacker can exploit a log injection vulnerability by

Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization reque

The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Improper Output Ne

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 an

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes l

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre

In Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.5.0, an unauthenticated attacker coul

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content into Navigator log

IBM MQ Operator (SC2 v3.2.0–3.8.1, LTS v2.0.0–2.0.29) and IBM‑supplied MQ Advanced container images (across affected SC2

IBM Maximo Application Suite - Monitor Component 9.1, 9.0, 8.11, and 8.10 could allow an unauthorized user to inject dat

openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after cl

openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the

openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info

Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on Windows

The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled,