CWE-117

134 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 8High 19Medium 97Low 8Not scored 2

CVEs per yearBy the year they were published

CVE-2026-103864
Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
Apache Software Foundation · Apache Sling Engine
Not scored
CVE-2026-111211
Potential log injection via unescaped geometry form values
djangoproject · Django
Medium6.9
CVE-2026-118994
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name
CallBackery
Not scored
CVE-2026-119423
OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username
opnsense · core
Medium6.9
CVE-2026-117977
Other issue in the Console component
Mozilla · Firefox
High8.1
CVE-2026-15661
IBM Concert Software Improper Output Neutralization for Logs
IBM · Concert
Medium5.3
CVE-2026-63442
OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking
opnsense · core
High8.1
CVE-2026-109786
In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host address. Because…
fail2ban · fail2ban
Medium5.3
CVE-2026-41504
OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields
corazawaf · coraza
Medium5.8
CVE-2026-76267
Log Injection through the REST API in Splunk App for Splunk O11y Cloud
Splunk · Splunk Enterprise
Medium4.3