Improper Validation of Specified Quantity in Input

Overview djangorestframework is a powerful and flexible toolkit for building Web APIs. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input through Request.parse in restframework/request.py. An attacker can make request.data accept oversized...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON JavaScript Object Notation data to a service that reads and processes it. This can lead to a Denial of Service Do...

CVE-2026-73555

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts FastAPI RequestValidationError objects with strexc, and sanitizemessage in vllm/entrypoints/utils.py does not remove traceback-styl...

CVE-2026-73618

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON...

CVE-2026-73618 Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON...

CVE-2026-73618 Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON...

EUVD-2026-57822

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON...

CVE-2026-73618

Budibase Server prior to 3.40.0 is affected by a NoSQL injection in the MongoDB query execution endpoint. User-supplied parameters are interpolated into JSON query templates without sanitizing JSON metacharacters, allowing attackers with query write permission to inject JSON structural characters...

CVE-2026-73618 Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON...

Kibana 9.4.5 Security Update (ESA-2026-82)

Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not...

CVE-2026-29036

A flaw was found in cJSON, a JSON parser and generator. This vulnerability allows unauthenticated attackers to manipulate JSON Patch operations by supplying crafted JSON Pointer escape sequences. This can lead to silent corruption of data or the deletion of unintended keys, potentially bypassing...

PT-2026-71670

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.26.0 Description An issue exists where the validation exception handler in vllm/entrypoints/openai/server utils.py converts FastAPI RequestValidationError objects using strexc, and the sanitize message function in...

Vim 9.2.0511 < 9.2.0844 Use-After-Free (GHSA-69ch-22ch-r887)

The version of Vim installed on the remote host is between 9.2.0511 and 9.2.0844 exclusive. It is, therefore, affected by a vulnerability as referenced in the GHSA-69ch-22ch-r887 advisory. - From 9.2.0511 until 9.2.0844, jsondecodeitem in src/json.c can retain a stale pointer after jsondecodestri...

CVE-2026-72680: Authorization Bypass Through User-Controlled Key

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...

PT-2026-71790

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description The Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from user-supplied input. The ownership check for this identifier fails to distinguish between a...

Linux Distros Unpatched Vulnerability : CVE-2026-29036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c tha...

CVE-2026-73555: Generation of Error Message Containing Sensitive Information

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts FastAPI RequestValidationError objects with strexc, and sanitizemessage in vllm/entrypoints/utils.py does not remove traceback-styl...

CVE-2026-73502

creationtimestamp| type| source ---|---|--- 2026-08-12 22:35:02+00:00| published-proof-of-concept| https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq...

CVE-2026-73071

A flaw was found in Vim. When processing an invalid JSON string that spans multiple buffers, the jsondecodeitem function can retain a stale pointer. This can lead to the program attempting to read freed memory, potentially resulting in a denial of service for a local user. Mitigation Not applicab...