Vulnerabilities

TI-2026-66127 CVE-2026-104721 · GHSA-5f86-rhcp-cxm6

Logback: Incomplete protection against CVE-2026-19880

LOW 28

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00332 Published 2026-10-02 Partial fix · 1.6.5 CWE-22

TI-2026-16116 CVE-2026-19880 · GHSA-9mh8-hq67-v26g

Incomplete protection against CVE-2025-11226

LOW 28

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00332 Published 2026-08-14 Partial fix · 1.6.3 CWE-22

TI-2026-11065 CVE-2026-13006 · GHSA-567r-vvh5-jjr8

Incomplete protection against CVE-2025-11226

LOW 32

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protectio…

CVSS 4.0HIGH 7.0 Local High privileges No interaction EPSS 0.00175 Published 2026-06-24 Partial fix · 1.5.37 CWE-20

TI-2026-09059 CVE-2026-10532 · GHSA-jhq6-gfmj-v8fx

Logback deserialization whitelist bypass for Proxy objects

LOW 15

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.0037 Published 2026-06-01 Fixed in 1.5.34 CWE-502

TI-2026-08607 CVE-2026-9828 · GHSA-p47f-322f-whfh

Logback deserialization whitelist bypass for java.lang and java.util

LOW 15

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.0037 Published 2026-05-28 Fixed in 1.5.33 CWE-502

TI-2026-00946 CVE-2026-1225 · GHSA-qqpg-mvqg-649v

Malicious logback.xml configuration file allows instantiation of arbitrary classes

LOW 9

ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromisi…

CVSS 4.0LOW 1.8 Local High privileges No interaction EPSS 0.00162 Published 2026-01-22 Partial fix · 1.5.25 CWE-20

TI-2025-10282 CVE-2025-11226 · GHSA-25qh-j22f-pwp8

Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino

LOW 32

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logb…

CVSS 4.0HIGH 7.0 Local High privileges No interaction EPSS 0.00194 Published 2025-10-01 Partial fix · 1.5.19, 1.3.16 CWE-20

TI-2024-11863 CVE-2024-12801 · GHSA-6v67-2wr5-gvf4

SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks

LOW 12

Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in…

CVSS 4.0LOW 2.4 Local Low privileges User interaction EPSS 0.00226 Published 2024-12-19 Partial fix · 1.3.15, 1.5.13 CWE-918

TI-2024-11860 CVE-2024-12798 · GHSA-pr98-23f8-jwxv

JaninoEventEvaluator vulnerability

LOW 29

ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback…

CVSS 4.0MEDIUM 5.9 Local Low privileges User interaction EPSS 0.00458 Published 2024-12-19 Partial fix · 1.3.15, 1.5.13 CWE-917

Vulnerabilities

Filters