42
55
55
55
30
55
55
30
47
55
42
42
55
55
30
30
55
30
55
30
55
55
55
55
55
30
60
55
55
55
55
CVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources
Apache ZooKeeper audit logs are vulnerable to arbitrary field injection by unauthenticated attackers via tab characters in digest auth requests.
CVE-2026-84439 (important severity) affects Apache ZooKeeper 3.9.0-3.9.5 and 3.8.0-3.8.6 when audit logging is enabled (zookeeper.audit.enable=true). An unauthenticated attacker can inject arbitrary fields into the audit log by sending a digest authentication request with embedded tab characters, undermining audit trail integrity and potentially enabling log-analysis evasion or spoofing.
35
55
30
CVE-2026-75015: Apache Syncope: Nested secrets leak cleartext into audit records readable
Apache Syncope leaks nested secrets in cleartext into audit records readable by unauthorized users; affects 3.0.x, 4.0.x, and 4.1.x versions.
CVE-2026-75015 is an insufficiently protected credentials vulnerability in Apache Syncope where audit events expose nested secrets in cleartext to users able to read those records. Affected component is syncope-core-provisioning-java 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Apache rates the issue moderate severity, and users should upgrade to fixed releases.
18
55
55
30
55
30