By weakness (CWE)

CWE-117: related vulnerabilities

CVEs classified under CWE-117. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

5 published vulnerabilities

• CVE-2026-45565HIGH 8.1

  Roxy-WI, a web management interface for popular open-source load balancers and reverse proxes, contains a flaw in how it validates user input across dozens of fields—including SSH credentials and server descriptions. An attacker with login credentials can bypass security checks by appending certain shell metacharacters to a path traversal payload, allowing them to read or modify files outside the intended scope. The vulnerability affects versions 8.2.6.4 and earlier, with no public patches available at publication.

• CVE-2026-45679MEDIUM 6.5

  OpenTelemetry eBPF Instrumentation versions before 0.9.0 leak sensitive data through telemetry systems. When Redis commands fail, the instrumentation captures and exports the raw error messages produced by Redis. Attackers or misconfigured systems can craft Redis error responses containing authentication tokens, personally identifiable information, or other secrets. These sensitive values then flow into your telemetry backend—where security teams, SREs, and external monitoring vendors can see them—and may propagate into downstream analysis, alerting, or visualization tools. This is a data exfiltration vulnerability that risks exposing confidential input into systems where it was never intended to be visible.

• CVE-2026-5078MEDIUM 5.3

  Morgan, a popular Node.js HTTP request logging middleware, has a vulnerability in how it handles usernames from HTTP Basic authentication. When processing login attempts, the logging middleware extracts the username and writes it to application logs without sanitizing special control characters like line breaks. An attacker can craft a fake login attempt with hidden line-break characters embedded in the username field, causing the log entry to split across multiple lines and appearing to contain forged log records. This can deceive downstream systems that rely on logs for security monitoring or compliance auditing.

• CVE-2026-9016MEDIUM 5.3

  A WordPress plugin called Debug Log Manager allows website visitors—including those not logged in—to write fake error messages directly into the site's debug log. The plugin publishes a security token publicly in every page's HTML code, defeating its own authorization checks. An attacker can exploit this to flood the log with fabricated entries, making it harder for administrators to spot real problems and potentially covering up malicious activity. This only affects sites that have the plugin's JavaScript error logging feature enabled.

• CVE-2026-20260MEDIUM 4.3

  A flaw in Splunk SOAR (prior to version 8.5.0) allows an attacker without authentication to insert special control codes into application log files by crafting malicious URLs. If a system administrator later views those logs in a terminal, the codes could cause unexpected behavior—such as hiding text, changing colors, or executing terminal commands. This is a log injection vulnerability that bridges the gap between the attacker's network access and a human's interactive terminal session.