1157 matches found
GHSA-XF85-363P-868W vulnerabilities
Vulnerabilities for packages: maru, helm-push, tw, consul-k8s, falcoctl, helm-mapkubeapis, kube-arangodb, gitness, trivy, argo-cd, vcluster, rancher-helm, helm-operator, ratify, cilium-cli, gatekeeper, steampipe, k8ssandra-client, teleport, headlamp, oras, zarf, tigera-operator, cert-manager-cmct...
PT-2026-54936
Name of the Vulnerable Software and Affected Versions Eclipse Parsson versions prior to 1.1.8 Description The JSON parser does not enforce a default maximum on the number of characters consumed when parsing a single JSON document. This allows an attacker to provide specially crafted JSON document...
qs: qs: Denial of Service via improper input validation in array parsing
A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation e.g., a=value. This bypasses the arrayLimit option, which is designed to limit the size of...
CVE-2026-53426 Atom-table exhaustion denial-of-service via JSON parse_document in MDEx
Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allows Excessive Allocation. MDEx.parsedocument/2 accepts a :json, json source. In lib/mdex.ex, the private jsontonode/1 function passes the attacker-controlled nodetype value to Module.concat/1, which calls...
PYSEC-2026-319 Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
Summary The safeevalexpression function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes giframe, fback, fbuiltins do NOT start with underscore, enabling a complete sandbox escape to achieve...
PT-2026-53575
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape dict...
xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
...
CVE-2026-39395 vulnerabilities
Vulnerabilities for packages: kyverno, ratify, crossplane, trivy-fips, policy-controller-fips, crossplane-fips, chainctl-fips, kubescape, commercial-chainloop-backend, trivy-operator, teleport, slsa-verifier, cloudbeat, commercial-kyverno, kyverno-notation-aws-fips, trivy, kyverno-notation-aws,...
GHSA-W6C6-C85G-MMV6 vulnerabilities
Vulnerabilities for packages: kyverno, ratify, crossplane, trivy-fips, policy-controller-fips, crossplane-fips, chainctl-fips, kubescape, commercial-chainloop-backend, trivy-operator, teleport, slsa-verifier, cloudbeat, commercial-kyverno, kyverno-notation-aws-fips, trivy, kyverno-notation-aws,...
RLSA-2023:6976 Moderate: libfastjson security update
The libfastjson library provides essential JavaScript Object Notation JSON handling functions. The library enables users to construct JSON objects in C, output them as JSON-formatted strings, and convert JSON-formatted strings back to the C representation of JSON objects. Security Fixes: json-c,...
CVE-2026-54350
Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection and, where the builder has published a PUBLIC write...
CVE-2026-48702 vulnerabilities
Vulnerabilities for packages: tflint-fips, kyverno, ratify, crossplane, spire-server-fips, tekton-chains, policy-controller-fips, tbot, crossplane-fips, chainctl-fips, gitsign, kubescape, falcoctl, neuvector-sigstore-interface-fips, tkn-fips, goreleaser, trivy-operator, teleport, ko, slsa-verifie...
GHSA-47Q9-M4WW-924M vulnerabilities
Vulnerabilities for packages: tflint-fips, kyverno, ratify, crossplane, spire-server-fips, tekton-chains, policy-controller-fips, tbot, crossplane-fips, chainctl-fips, gitsign, kubescape, falcoctl, neuvector-sigstore-interface-fips, tkn-fips, goreleaser, trivy-operator, teleport, ko, slsa-verifie...
CVE-2026-48042
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O100K nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1...
EUVD-2026-39145
Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing...
CVE-2026-9785
Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing...
CVE-2026-48028
Mastodon (open-source social network server) versions prior to 4.5.10, 4.4.17, and 4.3.23 are affected. The vulnerability arises from how incoming activities signed with Linked-Data Signatures are normalized, failing to adequately protect against a class of spoofing that lets an attacker remove J...
CVE-2026-46349 Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures does not sufficiently protect the activities from a certain class of spoofing, allowing attackers to...
RHEL 9 : libtasn1 (RHSA-2026:28253)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:28253 advisory. A library that provides Abstract Syntax Notation One ASN.1, as specified by the X.680 ITU-T recommendation parsing and structures management, and...
