56551 matches found
CVE-2026-78416
Craft CMS versions 4.0.0-RC1 through 4.18.1 and 5.0.0-RC1 through 5.10.5 are affected by an authenticated remote code execution vulnerability in the control panel element-search condition handling. The root cause is a JSON cleanse bypass in condition.config that allows Yii behavior/event configur...
MAL-2026-14405 Malicious code in create-json-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed8ecd294b2515f40dbcea497a8a597797b26ca773d6944a3f207249fbbce503 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in create-json-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed8ecd294b2515f40dbcea497a8a597797b26ca773d6944a3f207249fbbce503 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
CVE-2025-63080
Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...
CVE-2025-63080
KAON PG5298A and PG5298B routers contain an insufficient access control flaw in their JSON-RPC interface . An authenticated user on the adjacent network can send crafted JSON-RPC requests to perform operations that are otherwise restricted to the GUI, enabling system file read or command executio...
EUVD-2025-210761
Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...
CVE-2025-63080 Authenticated RCE in KAON PG5298
Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...
CVE-2025-63080 Authenticated RCE in KAON PG5298
Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...
Security Bulletin: Vulnerability in WebSphere Application Server Liberty affect Cloud Pak System Pattern Type
Summary Denial of service vulnerability affects WebSphere Application Server Liberty which is bundled as WebSphere Application Server liberty pattern type with IBM Cloud Pak System CVE-2026-9563 Vulnerability Details CVEID:CVE-2026-9563 DESCRIPTION: In Eclipse Parsson published Maven Central...
CVE-2026-78207 exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization
exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject proto, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious proto property to cell notes, modifying Object.prototype and affecting...
CVE-2026-78207 exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization
exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject proto, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious proto property to cell notes, modifying Object.prototype and affecting...
CVE-2026-78207: Improperly Controlled Modification of Object Prototype Attributes
exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject proto, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious proto property to cell notes, modifying Object.prototype and affecting...
CVE-2025-63080: Incorrect Authorization
Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...
PT-2026-80909
Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.18.1 Craft CMS versions 5.0.0-RC1 through 5.10.5 Description An authenticated remote code execution issue exists in the control panel element-search condition handling. A JSON cleanse bypass in...
CVE-2026-78416: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interprete...
PT-2026-81072
Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Fabric.js. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on t...
PT-2026-80800
Name of the Vulnerable Software and Affected Versions KAON PG5298A versions prior to 3.0.82 KAON PG5298B versions prior to 4.0.82 Description Authenticated users can send crafted JSON-RPC requests to perform unauthorized operations that are not available through the graphical user interface, such...
MiracleLinux 9 : grafana-10.2.6-23.el9_8.1 (AXSA:2026-1633:24)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1633:24 advisory. grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads CVE-2026-42127 Tenable has extracted the preceding description...
