CWE-117 Improper Output Neutralization for Logs

Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields

morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

morgan vulnerable to Log Forging via unescaped Unicode line separators

@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

netfoil vulnerable to improper handling of untrusted DoH response data

Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server

Keycloak vulnerable to log Injection during WebAuthn authentication or registration

morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

netfoil: Attacker controlled data written to logs

Ansible-core information disclosure flaw

OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages

flask-cors vulnerable to log injection when the log level is set to debug

Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility

Keycloak logs sensitive headers

OliveTin's email argument makes compliance harder, enables log injection

OpenClaw log poisoning (indirect prompt injection) via WebSocket headers

Neo4j Enterprise and Community editions have insufficient escaping of unicode characters in query log

go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data

Duplicate Advisory: go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data

Apache Struts Extras Before 2 has an Improper Output Neutralization for Logs Vulnerability

Jenkins has a log message injection vulnerability

Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

Possible Log Injection in Rack::CommonLogger

MS SWIFT WEB-UI RCE Vulnerability