CWE-117 · 127 records

Improper Output Neutralization for Logs

CVEs in this class

127 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2026-17481No exploit	IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code executionibm · documentation offline · CWE-117 pre-auth RCE	Critical9.8	—	0.9%	Aug 13, 2026
39Monitor	CVE-2015-10011No exploit	OpenDNS OpenResolve endpoints.py neutralization for logscisco · openresolve · CWE-117 Pre-auth	Critical9.8	—	0.9%	Jan 2, 2023
39Monitor	CVE-2024-0987No exploit	Sichuan Yougou Technology KuERP log neutralization for logskuerp project · kuerp · CWE-117 Pre-auth	Critical9.8	—	0.8%	Jan 28, 2024
39Monitor	CVE-2023-46321No exploit	iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs.iterm2 · iterm2 · CWE-117 Pre-auth	Critical9.8	—	0.6%	Oct 22, 2023
39Monitor	CVE-2023-46322No exploit	iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs.iterm2 · iterm2 · CWE-117 Pre-auth	Critical9.8	—	0.6%	Oct 22, 2023
37Monitor	CVE-2026-81695No exploit	openssl_encrypt before 1.4.9 Terminal Injection via key_idjahlives · openssl encrypt · CWE-117 Pre-auth	Critical9.3	—	0.2%	Aug 27, 2026
37Monitor	CVE-2026-81694No exploit	verify-usb before 1.4.9 Output Injection via Unsanitized Filenamesjahlives · openssl encrypt · CWE-117 Pre-auth	Critical9.3	—	0.2%	Aug 27, 2026
37Monitor	CVE-2026-81696No exploit	openssl_encrypt before 1.4.9 Terminal Injection via info Commandjahlives · openssl encrypt · CWE-117 Pre-auth	Critical9.3	—	0.2%	Aug 27, 2026
37Monitor	CVE-2026-74885No exploit	openssl_encrypt before 1.4.0 Logging Bug and Race Conditionjahlives · openssl encrypt · CWE-117 Pre-auth Race condition	Critical9.3	—	0.2%	Aug 17, 2026
35Monitor	CVE-2024-47083No exploit	Power Platform Terraform Provider has Improper Masking of Secrets in Logsmicrosoft · power platform terraform provider · CWE-117	High8.8	—	1.5%	Sep 25, 2024
34Monitor	CVE-2024-25047No exploit	IBM Cognos Analytics log injectionibm · cognos analytics · CWE-117 Pre-auth	High8.6	—	0.6%	May 2, 2024
34Monitor	CVE-2023-4571No exploit	Unauthenticated Log Injection in Splunk IT Service Intelligence (ITSI)splunk · it service intelligence · CWE-117	High8.6	—	0.2%	Aug 30, 2023
32Monitor	CVE-2022-22151No exploit	CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versiyokogawa · centum cs 3000 firmware · CWE-117	High8.1	—	0.8%	Mar 11, 2022
32Monitor	CVE-2025-57564No exploit	CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems via the /api/logs/inserCWE-117 Pre-auth	High8.2	—	0.3%	Oct 7, 2025
32Monitor	CVE-2026-63442No exploit	OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blockingopnsense · core · CWE-117 Pre-auth	High8.1	—	0.2%	Oct 15, 2026
31Monitor	CVE-2019-14846No exploit	In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG redhat · ansible engine · CWE-117	High7.8	—	0.5%	Oct 8, 2019
31Monitor	CVE-2026-10745No exploit	Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on Windows allows Log Injectioupkeeper solutions · upkeeper instant privilege access · CWE-117 Pre-auth	High7.9	—	0.4%	Jun 24, 2026
31Monitor	CVE-2023-3997No exploit	Unauthenticated Log Injection In Splunk SOARsplunk · soar · CWE-117	High7.8	—	0.2%	Jul 31, 2023
30Monitor	CVE-2020-25646No exploit	A flaw was found in Ansible Collection community.crypto.ansible collections project · community.crypto · CWE-117 Pre-auth	High7.5	—	1.4%	Oct 29, 2020
30Monitor	CVE-2024-9606No exploit	Improper Output Neutralization for Logs in berriai/litellmlitellm · litellm · CWE-117 Pre-auth	High7.5	—	0.7%	Mar 20, 2025
30Monitor	CVE-2025-3942No exploit	Improper Output Neutralization for Logstridium · niagara · CWE-117 Pre-auth	High7.5	—	0.3%	May 22, 2025
30Monitor	GHSA-9h6h-9g78-86f7No exploit	Yapscan's report receiver server vulnerable to path traversal and log injectionGo · github.com/fkie-cad/yapscan · CWE-117 Pre-auth Path traversal	High7.5	—	—	Dec 29, 2022
28Monitor	CVE-2024-0095No exploit	NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where a user can inject forged logs and executable commands bynvidia · triton inference server · CWE-117	High7.2	—	0.5%	Jun 13, 2024
27Monitor	CVE-2019-14864No exploit	Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it redhat · ansible · CWE-117	Medium6.5	—	1.8%	Jan 2, 2020
27Monitor	CVE-2021-42250No exploit	Possible log injectionapache · superset · CWE-117	Medium6.5	—	1.8%	Nov 17, 2021

CVE-2026-17481
39Monitor
IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
ibm · documentation offlineAug 13, 2026
CVE-2015-10011
39Monitor
OpenDNS OpenResolve endpoints.py neutralization for logs
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
cisco · openresolveJan 2, 2023
CVE-2024-0987
39Monitor
Sichuan Yougou Technology KuERP log neutralization for logs
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
kuerp project · kuerpJan 28, 2024
CVE-2023-46321
39Monitor
iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
iterm2 · iterm2Oct 22, 2023
CVE-2023-46322
39Monitor
iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
iterm2 · iterm2Oct 22, 2023
CVE-2026-81695
37Monitor
openssl_encrypt before 1.4.9 Terminal Injection via key_id
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
jahlives · openssl encryptAug 27, 2026
CVE-2026-81694
37Monitor
verify-usb before 1.4.9 Output Injection via Unsanitized Filenames
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
jahlives · openssl encryptAug 27, 2026
CVE-2026-81696
37Monitor
openssl_encrypt before 1.4.9 Terminal Injection via info Command
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
jahlives · openssl encryptAug 27, 2026
CVE-2026-74885
37Monitor
openssl_encrypt before 1.4.0 Logging Bug and Race Condition
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Race condition
jahlives · openssl encryptAug 17, 2026
CVE-2024-47083
35Monitor
Power Platform Terraform Provider has Improper Masking of Secrets in Logs
HighCVSS 8.8No exploitEPSS 1%
microsoft · power platform terraform providerSep 25, 2024
CVE-2024-25047
34Monitor
IBM Cognos Analytics log injection
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
ibm · cognos analyticsMay 2, 2024
CVE-2023-4571
34Monitor
Unauthenticated Log Injection in Splunk IT Service Intelligence (ITSI)
HighCVSS 8.6No exploitEPSS 0%
splunk · it service intelligenceAug 30, 2023
CVE-2022-22151
32Monitor
CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versi
HighCVSS 8.1No exploitEPSS 0%
yokogawa · centum cs 3000 firmwareMar 11, 2022
CVE-2025-57564
32Monitor
CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems via the /api/logs/inser
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
Oct 7, 2025
CVE-2026-63442
32Monitor
OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
opnsense · coreOct 15, 2026
CVE-2019-14846
31Monitor
In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG
HighCVSS 7.8No exploitEPSS 0%
redhat · ansible engineOct 8, 2019
CVE-2026-10745
31Monitor
Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on Windows allows Log Injectio
HighCVSS 7.9No exploitEPSS 0%
- Pre-auth
upkeeper solutions · upkeeper instant privilege accessJun 24, 2026
CVE-2023-3997
31Monitor
Unauthenticated Log Injection In Splunk SOAR
HighCVSS 7.8No exploitEPSS 0%
splunk · soarJul 31, 2023
CVE-2020-25646
30Monitor
A flaw was found in Ansible Collection community.crypto.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
ansible collections project · community.cryptoOct 29, 2020
CVE-2024-9606
30Monitor
Improper Output Neutralization for Logs in berriai/litellm
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
litellm · litellmMar 20, 2025
CVE-2025-3942
30Monitor
Improper Output Neutralization for Logs
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
tridium · niagaraMay 22, 2025
GHSA-9h6h-9g78-86f7
30Monitor
Yapscan's report receiver server vulnerable to path traversal and log injection
HighCVSS 7.5No exploit
- Pre-auth
- Path traversal
Go · github.com/fkie-cad/yapscanDec 29, 2022
CVE-2024-0095
28Monitor
NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where a user can inject forged logs and executable commands by
HighCVSS 7.2No exploitEPSS 0%
nvidia · triton inference serverJun 13, 2024
CVE-2019-14864
27Monitor
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it
MediumCVSS 6.5No exploitEPSS 1%
redhat · ansibleJan 2, 2020
CVE-2021-42250
27Monitor
Possible log injection
MediumCVSS 6.5No exploitEPSS 1%
apache · supersetNov 17, 2021

All vulnerability classes