morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separ...

CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes l

历史摘要 · 未重新核验 · NVD

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing e...

CVE-2026-81696

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info

历史摘要 · 未重新核验 · NVD

openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with ...

CVE-2026-81695

openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt

历史摘要 · 未重新核验 · NVD

openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in ...

CVE-2026-81694

openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the

历史摘要 · 未重新核验 · NVD

openssl_encrypt before 1.4.9 Terminal Injection via info Command

CVE-2026-81696

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info

历史摘要 · 未重新核验 · OSV.dev

openssl_encrypt before 1.4.9 Terminal Injection via key_id

CVE-2026-81695

openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt

历史摘要 · 未重新核验 · OSV.dev

verify-usb before 1.4.9 Output Injection via Unsanitized Filenames

CVE-2026-81694

openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the

历史摘要 · 未重新核验 · OSV.dev

@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

CVE-2026-54511

`@logtape/syslog` contains two related output-encoding bugs in the structured data formatting code. Both only affect dep

历史摘要 · 未重新核验 · GitHub Advisory

netfoil vulnerable to improper handling of untrusted DoH response data

### Summary HTTPS RR data returned from the DoH server was not properly handled. Unverified APLN data (which could conta

历史摘要 · 未重新核验 · GitHub Advisory

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic a...

CVE-2026-44256

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 an

历史摘要 · 未重新核验 · NVD

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary...

CVE-2026-17481

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper ou

历史摘要 · 未重新核验 · GitHub Advisory

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper output neutralization for logs.

CVE-2026-17481

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper ou

历史摘要 · 未重新核验 · NVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary...

CVE-2026-18148

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content into Navigator log

历史摘要 · 未重新核验 · GitHub Advisory

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content into Navigator log files due to improper output neutralization for logs.

CVE-2026-18148

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content into Navigator log

历史摘要 · 未重新核验 · NVD

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `/api/log` endpoint accepts unauthenticat...

CVE-2026-48083

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

历史摘要 · 未重新核验 · NVD

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/state...

CVE-2026-62948

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN opt

历史摘要 · 未重新核验 · NVD

OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI

CVE-2026-62948

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN opt

历史摘要 · 未重新核验 · OSV.dev

morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

CVE-2026-5078

### Impact Morgan's `:remote-user` token extracts the Basic auth username from the `Authorization` header and writes it

历史摘要 · 未重新核验 · GitHub Advisory

netfoil: Attacker controlled data written to logs

### Summary Domain names were written to the log without first being validated to contain allowed characters. ### Impac

历史摘要 · 未重新核验 · GitHub Advisory

The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into three log statements ...

CVE-2026-12616

The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled,

历史摘要 · 未重新核验 · NVD