PT-2026-24651

Impact An attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with t...

[SECURITY] Fedora 44 Update: php-zumba-json-serializer-3.2.4-1.fc44

This is a library to serialize PHP variables in JSON format. It is similar of the serialize function in PHP, but the output is a string JSON encoded. You can also unserialize the JSON generated by this tool and have you PHP content back. Autoloader: /usr/share/php/Zumba/JsonSerializer/autoload.ph...

CVE-2026-28501

WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components. The application fails to properly sanitize the catName parameter when it is supplied via a...

Security Bulletin: A vulnerability in JavaScript qs package affect IBM® Db2® Big SQL on IBM Cloud Pak for Data.

Summary A vulnerability in JavaScript qs package affect IBM® Db2® Big SQL 8.3 on IBM Cloud Pak for Data 5.3 and earlier. Vulnerability Details CVEID:CVE-2025-15284 DESCRIPTION: Improper Input Validation vulnerability in qs parse modules allows HTTP DoS.This issue affects qs: 6.14.1. Summary The...

MCP Go SDK JSON Unmarshal Bypass

The vulnerability of the json.Unmarshal function in the JSON-RPC protocol implementation of the MCP Go SDK is related to deficiencies in the mechanism for processing register-dependent data. Exploiting this vulnerability allows a malicious actor to bypass existing security measures by sending...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: ceph-csi-operator-fips, buildkitd, k8sgateway, gitlab-cng-fips, docker-compose, onepassword-operator, sftpgo-plugin-kms, kubernetes, gitlab-runner, falcosidekick-fips, tfsec, metrics-server-fips, ops-agent, k8s-agents-operator-fips, kserve, terraform-fips, deschedule...

CVE-2021-4456

Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions addr2cidr and cidrlookup may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker ma...

Interpretation Conflict

Overview Affected versions of this package are vulnerable to Interpretation Conflict in the JSON-RPC and MCP protocol message parsing. An attacker can bypass intermediary inspection or cause cross-implementation inconsistencies by sending protocol messages with non-standard field casing or Unicod...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: zot, melange, apko, flux-notification-controller, docker, xeol, buildkitd, flux-kustomize-controller, argo-rollouts, crossplane-provider-azure-authorization, gitsign, vcluster, flux-source-controller, helm, crossplane-provider-aws-cloudfront, grype,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: zot, melange, apko, flux-notification-controller, docker, xeol, buildkitd, flux-kustomize-controller, argo-rollouts, crossplane-provider-azure-authorization, gitsign, vcluster, flux-source-controller, helm, crossplane-provider-aws-cloudfront, grype,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: rancher-fleet, flux-image-automation-controller-fips, helm-push, flux-kustomize-controller-fips, crossplane-provider-family-aws-fips, amazon-ssm-agent, buildkitd, kyverno-notation-aws-fips, scorecard, src-fingerprint, crossplane-provider-aws-kinesis-fips, grafana,...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in qs-6.13.0.tgz

Summary IBM Watson Discovery Cartridge affected by vulnerability in qs-6.13.0.tgz Vulnerability Details CVEID:CVE-2025-15284 DESCRIPTION: Improper Input Validation vulnerability in qs parse modules allows HTTP DoS.This issue affects qs: 6.14.1. SummaryThe arrayLimit option in qs does not enforce...

CVE-2026-27896 MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would also match "Method", "METHOD", etc...

[SECURITY] Fedora 42 Update: python-pyasn1-0.6.2-1.fc42

This is an implementation of ASN.1 types and codecs in the Python programming language...

PT-2026-21362

Name of the Vulnerable Software and Affected Versions ASN.1 TypeScript ESM library versions 11.0.5 and below Description The ASN.1 TypeScript ESM library, which includes codecs for Basic Encoding Rules BER and Distinguished Encoding Rules DER, has an issue where decoding an INTEGER could...

CVE-2025-65519

mayswind ezbookkeeping versions 1.2.0 and earlier contain a critical vulnerability in JSON and XML file import processing. The application fails to validate nesting depth during parsing operations, allowing authenticated attackers to trigger denial of service conditions by uploading deeply nested...

ezBookkeeping 安全漏洞

ezBookkeeping is a lightweight personal accounting application developed by mayswind developers. Versions of ezBookkeeping 1.2.0 and earlier contained security vulnerabilities. These vulnerabilities stemmed from the lack of validation of nested depths during the processing of JSON and XML file...

axios mergeConfig JSON DoS

The vulnerability of the mergeConfig function in the axios library is related to insufficient checks for exceptional states. Exploiting this vulnerability could allow a malicious actor to trigger a service failure by sending a specially crafted JSON file...

CVE-2026-25494

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation uses filtervar..., FILTERVALIDATEIP to block a specific list of IP addresses. However, alternative IP notations hexadecimal, mixed are not...

CVE-2026-25925

PowerDocu contains a Windows GUI executable to perform technical documentations. Prior to 2.4.0, PowerDocu contains a critical security vulnerability in how it parses JSON files within Flow or App packages. The application blindly trusts the $type property in JSON files, allowing an attacker to...