Monthly
Log injection in IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 allows unauthenticated remote actors to insert forged or malformed entries into application log files by supplying input containing special characters such as CRLF sequences that are written to logs without sanitization. The integrity impact is limited to log tampering - attackers cannot read data, escalate privileges, or disrupt service through this flaw alone, but forged log records can mislead incident responders and undermine audit-trail integrity. No public exploit has been identified at time of analysis, and IBM has released a patch via its support portal.
Log injection in IBM Netezza Software 11.3.0.3 through Interim Fix 002 allows unauthenticated remote attackers to insert arbitrary content into log files by supplying input containing special characters - such as CRLF sequences - that is written to logs without proper neutralization. The vulnerability (CWE-117) enables falsification of audit trails, potential SIEM-alert manipulation, and degradation of forensic fidelity. No public exploit code or active exploitation has been identified; a vendor patch is available via IBM Support.
Log forging in morgan HTTP request logger middleware for Node.js (all versions prior to 1.12.0) allows unauthenticated remote attackers to inject Unicode line separator characters - U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator) - into log output via attacker-controlled token values such as the Basic auth username surfaced through the remote-user token. This causes Unicode-aware downstream log processors and SIEM pipelines to split a single HTTP request record into multiple logical entries, enabling false log injection and audit trail manipulation. This is an incomplete-fix follow-up to CVE-2026-5078, which addressed only ASCII control characters; no public exploit has been identified at time of analysis.
Terminal escape-sequence injection in jahlives openssl_encrypt before 1.4.9 lets an attacker embed control characters in a file's metadata that are emitted verbatim when a victim runs the tool's 'info' command, letting the attacker repaint the terminal and forge the integrity/verification output the tool displays. The practical impact is spoofing: a tampered or malicious file can be made to appear verified or trustworthy to the operator. No public exploit identified at time of analysis, and the flaw requires the victim to run 'info' on attacker-supplied input.
Terminal escape-sequence injection in jahlives' openssl_encrypt (a Python OpenSSL-based file encryption utility) before 1.4.9 lets an attacker embed ANSI/VT control sequences in the key_id field of a crafted encrypted file; because the tool prints this attacker-controlled value unescaped to stderr during decrypt key auto-detection, an attacker can repaint the terminal and forge authenticity-verification output to deceive the operator. Any user who decrypts a malicious file is affected. This is a CWE-117 output-neutralization flaw reported by VulnCheck with no public exploit identified at time of analysis and no CISA KEV listing.
Verdict spoofing in the openssl-encrypt pip package (versions <= 1.4.8) lets an attacker who controls the contents of a scanned drive forge a PASSED tamper-check result. Because filenames read from untrusted drive data are printed by the verify-usb command without neutralizing terminal control bytes, crafted names containing cursor-movement and erase-line sequences can repaint the screen to hide genuine tamper detection. There is no public exploit identified at time of analysis and it is not in CISA KEV; the issue is fixed in 1.4.9, which routes drive-derived names through sanitize_for_display().
Log injection in Wazuh's REST API (versions 4.4.0 through pre-4.14.6 and 5.0.0-beta1 through pre-5.0.0-beta2) allows an unauthenticated remote attacker to corrupt plain-text audit log integrity by embedding carriage return or line feed characters in the Basic authentication username field. Because the API middleware decodes the username before credential validation and passes the raw value to the access logger without control-character neutralization, the attacker can forge log entries, suppress evidence of prior activity, or poison upstream log aggregation pipelines. No public exploit has been identified at time of analysis, and the JSON log format is unaffected; the vendor-released patch is available in 4.14.6 and 5.0.0-beta2.
Audit-trail corruption and a security-control race condition in the Python library openssl_encrypt (by jahlives) before version 1.4.0 undermine its module-hiding defenses. The restore_hidden_modules() function logs module counts after clearing them, so it always records zero restored modules and produces misleading audit logs (CWE-117), while a separate time-of-check/time-of-use race between module hiding and import-hook installation lets a concurrent thread re-import modules that were meant to be blocked. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis and it is not on CISA KEV.
Remote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 stems from improper neutralization of output written to logs (CWE-117), which a remote attacker can leverage to run arbitrary code with total impact to confidentiality, integrity, and availability. IBM has published a fix, and the vendor CVSS of 9.8 reflects an unauthenticated network-reachable vector; however, EPSS is low (0.27%, 19th percentile) and there is no public exploit identified at time of analysis, so exposure appears theoretical rather than active. Note a signal conflict: the root-cause weakness is log injection, yet the stated impact is code execution - the intermediate mechanism is not documented in the available data.
Log injection in IBM i Navigator (versions 7.3 through 7.6) permits remote authenticated attackers to write arbitrary content into Navigator log files by exploiting improper output neutralization for logs (CWE-117). An attacker with low-privilege credentials can forge, corrupt, or spoof log entries, undermining audit trails and potentially masking malicious activity. IBM has released a patch via advisory node 7283292, and no public exploit code has been identified at time of analysis.
Log injection in IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 allows unauthenticated remote actors to insert forged or malformed entries into application log files by supplying input containing special characters such as CRLF sequences that are written to logs without sanitization. The integrity impact is limited to log tampering - attackers cannot read data, escalate privileges, or disrupt service through this flaw alone, but forged log records can mislead incident responders and undermine audit-trail integrity. No public exploit has been identified at time of analysis, and IBM has released a patch via its support portal.
Log injection in IBM Netezza Software 11.3.0.3 through Interim Fix 002 allows unauthenticated remote attackers to insert arbitrary content into log files by supplying input containing special characters - such as CRLF sequences - that is written to logs without proper neutralization. The vulnerability (CWE-117) enables falsification of audit trails, potential SIEM-alert manipulation, and degradation of forensic fidelity. No public exploit code or active exploitation has been identified; a vendor patch is available via IBM Support.
Log forging in morgan HTTP request logger middleware for Node.js (all versions prior to 1.12.0) allows unauthenticated remote attackers to inject Unicode line separator characters - U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator) - into log output via attacker-controlled token values such as the Basic auth username surfaced through the remote-user token. This causes Unicode-aware downstream log processors and SIEM pipelines to split a single HTTP request record into multiple logical entries, enabling false log injection and audit trail manipulation. This is an incomplete-fix follow-up to CVE-2026-5078, which addressed only ASCII control characters; no public exploit has been identified at time of analysis.
Terminal escape-sequence injection in jahlives openssl_encrypt before 1.4.9 lets an attacker embed control characters in a file's metadata that are emitted verbatim when a victim runs the tool's 'info' command, letting the attacker repaint the terminal and forge the integrity/verification output the tool displays. The practical impact is spoofing: a tampered or malicious file can be made to appear verified or trustworthy to the operator. No public exploit identified at time of analysis, and the flaw requires the victim to run 'info' on attacker-supplied input.
Terminal escape-sequence injection in jahlives' openssl_encrypt (a Python OpenSSL-based file encryption utility) before 1.4.9 lets an attacker embed ANSI/VT control sequences in the key_id field of a crafted encrypted file; because the tool prints this attacker-controlled value unescaped to stderr during decrypt key auto-detection, an attacker can repaint the terminal and forge authenticity-verification output to deceive the operator. Any user who decrypts a malicious file is affected. This is a CWE-117 output-neutralization flaw reported by VulnCheck with no public exploit identified at time of analysis and no CISA KEV listing.
Verdict spoofing in the openssl-encrypt pip package (versions <= 1.4.8) lets an attacker who controls the contents of a scanned drive forge a PASSED tamper-check result. Because filenames read from untrusted drive data are printed by the verify-usb command without neutralizing terminal control bytes, crafted names containing cursor-movement and erase-line sequences can repaint the screen to hide genuine tamper detection. There is no public exploit identified at time of analysis and it is not in CISA KEV; the issue is fixed in 1.4.9, which routes drive-derived names through sanitize_for_display().
Log injection in Wazuh's REST API (versions 4.4.0 through pre-4.14.6 and 5.0.0-beta1 through pre-5.0.0-beta2) allows an unauthenticated remote attacker to corrupt plain-text audit log integrity by embedding carriage return or line feed characters in the Basic authentication username field. Because the API middleware decodes the username before credential validation and passes the raw value to the access logger without control-character neutralization, the attacker can forge log entries, suppress evidence of prior activity, or poison upstream log aggregation pipelines. No public exploit has been identified at time of analysis, and the JSON log format is unaffected; the vendor-released patch is available in 4.14.6 and 5.0.0-beta2.
Audit-trail corruption and a security-control race condition in the Python library openssl_encrypt (by jahlives) before version 1.4.0 undermine its module-hiding defenses. The restore_hidden_modules() function logs module counts after clearing them, so it always records zero restored modules and produces misleading audit logs (CWE-117), while a separate time-of-check/time-of-use race between module hiding and import-hook installation lets a concurrent thread re-import modules that were meant to be blocked. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis and it is not on CISA KEV.
Remote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 stems from improper neutralization of output written to logs (CWE-117), which a remote attacker can leverage to run arbitrary code with total impact to confidentiality, integrity, and availability. IBM has published a fix, and the vendor CVSS of 9.8 reflects an unauthenticated network-reachable vector; however, EPSS is low (0.27%, 19th percentile) and there is no public exploit identified at time of analysis, so exposure appears theoretical rather than active. Note a signal conflict: the root-cause weakness is log injection, yet the stated impact is code execution - the intermediate mechanism is not documented in the available data.
Log injection in IBM i Navigator (versions 7.3 through 7.6) permits remote authenticated attackers to write arbitrary content into Navigator log files by exploiting improper output neutralization for logs (CWE-117). An attacker with low-privilege credentials can forge, corrupt, or spoof log entries, undermining audit trails and potentially masking malicious activity. IBM has released a patch via advisory node 7283292, and no public exploit code has been identified at time of analysis.