Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-117
Weakness type CWE-117 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 35 | 35 | 0 |
Monthly trend
▂▁▁▁▅▂▇█▃
2026-02 1 · 2026-03 0 · 2026-04 0 · 2026-05 0 · 2026-06 7 · 2026-07 1 · 2026-08 10 · 2026-09 12 · 2026-10 4
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-17481 | 9.8 | 59.5 | — | IBM Documentation Offline is vulnerable to information disclosure, session forgery and … |
| CVE-2026-84439 | 5.3 | 53.8 | — | Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources |
| CVE-2026-84501 | 5.3 | 53.8 | — | Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticati… |
| CVE-2026-86522 | 6.3 | 53.6 | — | Log injection via an unescaped password reset identity in AshAuthentication |
| CVE-2026-62948 | 9.6 | 46.6 | — | OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN… |
| CVE-2026-12616 | 6.9 | 44.2 | — | — |
| CVE-2026-44256 | 5.3 | 40.4 | — | Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username |
| CVE-2026-54511 | 8.6 | 39.7 | — | @logtape/syslog: syslog log injection via unescaped control characters and unvalidated … |
| CVE-2026-45565 | 8.1 | 39.1 | — | Roxy-WI: EscapedString validator skips its '..' block when stripping (root cause for se… |
| CVE-2026-9016 | 5.3 | 37.2 | — | Debug Log Manager <= 2.5.0 - Unauthenticated Improper Output Neutralization for Logs vi… |
| CVE-2026-10745 | 7.9 | 35.6 | — | — |
| CVE-2026-5078 | 5.3 | 34.3 | — | morgan vulnerable to Log Forging via unneutralized control characters in :remote-user |
| CVE-2026-87859 | 5.3 | 33.7 | — | morgan vulnerable to Log Injection via unescaped double quote in quoted log fields |
| CVE-2026-93421 | 5.3 | 33.1 | — | Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint |
| CVE-2026-41504 | 5.8 | 31.8 | — | OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via req… |
| CVE-2026-48083 | 6.5 | 28.7 | — | OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF inject… |
| CVE-2026-18148 | 4.3 | 26.5 | — | IBM i is Affected By Multiple Vulnerabilities in Navigator for i |
| CVE-2026-109786 | 5.3 | 22.8 | — | — |
| CVE-2026-15603 | 5.3 | 20.7 | — | morgan vulnerable to Log Forging via unescaped Unicode line separators |
| CVE-2026-9736 | 4.3 | 19.8 | — | Vulnerabilities exists in IBM Netezza Software |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| ibm | 8 |
| jahlives | 4 |
| morgan | 3 |
| apache | 2 |
| splunk | 2 |
| corazawaf | 1 |
| dahlia | 1 |
| eclipse foundation | 1 |
| fail2ban | 1 |
| invoiceplane | 1 |
| mesop-dev | 1 |
| open-reception | 1 |
| open-telemetry | 1 |
| openwrt | 1 |
| opnsense | 1 |
