CVE-2026-55891 PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri in lib/Request.php passes $SERVER'REQUESTURI' through FILTERSANITIZEURL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::init stores t...

CVE-2026-55891 PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri in lib/Request.php passes $SERVER'REQUESTURI' through FILTERSANITIZEURL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::init stores t...

CVE-2026-77184 MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in...

vamp-forticheck

vamp-forticheck VampSecure Labs — Security Research Division Scanner di vulnerabilità critiche nei dispositivi FortiOS/FortiGate. Descrizione Strumento di audit di sicurezza per valutare l'esposizione dei dispositivi Fortinet rispetto a quattro vulnerabilità critiche pubblicamente documentate...

CVE-2026-37736

An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...

Security Bulletin: Security Vulnerability in Nimbus Jose JWT Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-53864)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability in Nimbus Jose JWT Vulnerability Details CVEID:CVE-2025-53864 DESCRIPTION: Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a...

CVE-2026-55891: Improper Encoding or Escaping of Output

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri in lib/Request.php passes $SERVER'REQUESTURI' through FILTERSANITIZEURL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::init stores t...

EUVD-2026-67773

An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...

The vulnerability of the JSON data processing tool JQ, related to buffer overflows, allows attackers to trigger a denial-of-service attack.

The vulnerability of the JSON data processing tool JQ is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-83351

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri in lib/Request.php passes $ SERVER'REQUEST URI' through FILTER SANITIZE URL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller:: init...

PT-2026-83080

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to 30.1 Description Authentication is not enforced on the 'report4.json.php' and 'report4.1.json.php' endpoints. This allows unauthenticated users to send GET requests to these endpoints to retrieve daily and...

CVE-2026-37736

An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...

The vulnerability of the JSON data processing tool JQ, related to uncontrolled recursion, allows a hacker to cause a service failure.

The vulnerability of the JSON data processing tool JQ is related to uncontrolled recursion. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-37736

The OWASP json-sanitizer version v1.2.3 is affected by a vulnerability in the JsonSanitizer.sanitize() component. An attacker can provide a crafted input to trigger a Denial of Service (DoS) . The vulnerability is characterized as an Allocation of Resources Without Limits or Throttling . No speci...

CVE-2026-77184: Improper Neutralization of Special Elements used in an SQL Command

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in...

PT-2026-83126

An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-37736

An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-37736: Allocation of Resources Without Limits or Throttling

An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-59322 EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizin...

CVE-2026-81693

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...