Web Vulnerabilities
Log4Shell
Also: CVE-2021-44228
The December 2021 flaw in the Apache Log4j logging library, where logging a crafted message could make a server load and run remote code.
In more detail
Log4j could interpret special lookup expressions inside the text it was asked to log, including network lookups. Because nearly every application logs text it receives, such as user agents and usernames, the reach was enormous. The lasting lessons are about transitive dependencies and about logging as a place where untrusted input is processed.