CWE-117 · weakness in Injection and Smuggling
Improper Output Neutralization for Logs
140 CVEs
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 140 is a mark on the map. Named now: 1 to 26, most at risk first.
- log injection in Sling logging
- airavata-django-portal allows CRLF log injection because of the lack of escaping in the log statements
- Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callb…
- Possible log injection
- Power Platform Terraform Provider has Improper Masking of Secrets in Logs
- Arbitrary log line injection in github.com/gin-gonic/gin
- Apache Log4cxx: Improper escaping with JSONLayout
- Apache Log4cxx: Improper HTML escaping in HTMLLayout
- A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private key in logs. This directly impacts confidentiality
- In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additio…
- Triangle MicroWorks SCADA Data Gateway Event Log Improper Output Neutralization For Logs Arbitrary File Write Vulnerability
- Server log entry spoofing via newline injection
- Simple History Plugin Header neutralization for logs
- Log Forging in generator-jhipster-kotlin
- GateManager Audit Message Spoofing Vulnerability
- lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an attacker to inject shell control…
- Keycloak: log injection during webauthn authentication or registration
- OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privi…
- OpenDNS OpenResolve endpoints.py neutralization for logs
- Activity Log Plugin HTTP Header neutralization for logs
- IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution
- Sichuan Yougou Technology KuERP log neutralization for logs
- iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's initial character may be non-alphanumeric. The hostname's other charact…
- iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell metacharacters for a /usr/bin/man command line.
- An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote atta…
- CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM V…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.