57807 matches found
CVE-2026-73555
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts FastAPI RequestValidationError objects with strexc, and sanitizemessage in vllm/entrypoints/utils.py does not remove traceback-styl...
CVE-2026-73618
Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON...
EUVD-2026-57822
Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON...
CVE-2026-73618
Budibase Server prior to 3.40.0 is affected by a NoSQL injection in the MongoDB query execution endpoint. User-supplied parameters are interpolated into JSON query templates without sanitizing JSON metacharacters, allowing attackers with query write permission to inject JSON structural characters...
CVE-2026-73618 Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter
Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON...
CVE-2026-73618 Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter
Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON...
CVE-2026-73618 Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter
Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON...
Kibana 9.4.5 Security Update (ESA-2026-82)
Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not...
CVE-2026-29036
A flaw was found in cJSON, a JSON parser and generator. This vulnerability allows unauthenticated attackers to manipulate JSON Patch operations by supplying crafted JSON Pointer escape sequences. This can lead to silent corruption of data or the deletion of unintended keys, potentially bypassing...
CVE-2026-73555: Generation of Error Message Containing Sensitive Information
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts FastAPI RequestValidationError objects with strexc, and sanitizemessage in vllm/entrypoints/utils.py does not remove traceback-styl...
Vim 9.2.0511 < 9.2.0844 Use-After-Free (GHSA-69ch-22ch-r887)
The version of Vim installed on the remote host is between 9.2.0511 and 9.2.0844 exclusive. It is, therefore, affected by a vulnerability as referenced in the GHSA-69ch-22ch-r887 advisory. - From 9.2.0511 until 9.2.0844, jsondecodeitem in src/json.c can retain a stale pointer after jsondecodestri...
CVE-2026-73148
GHSA-6wgq-wg3w-jgvx: svxreflector: use-after-free write via dangling JSON reference...
PT-2026-71670
Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.26.0 Description An issue exists where the validation exception handler in vllm/entrypoints/openai/server utils.py converts FastAPI RequestValidationError objects using strexc, and the sanitize message function in...
PT-2026-71790
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description The Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from user-supplied input. The ownership check for this identifier fails to distinguish between a...
CVE-2026-72680: Authorization Bypass Through User-Controlled Key
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...
UBUNTU-CVE-2026-73148
GHSA-6wgq-wg3w-jgvx: svxreflector: use-after-free write via dangling JSON reference...
Linux Distros Unpatched Vulnerability : CVE-2026-29036
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c tha...
CVE-2026-73502
creationtimestamp| type| source ---|---|--- 2026-08-12 22:35:02+00:00| published-proof-of-concept| https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq...
CVE-2026-73071
A flaw was found in Vim. When processing an invalid JSON string that spans multiple buffers, the jsondecodeitem function can retain a stale pointer. This can lead to the program attempting to read freed memory, potentially resulting in a denial of service for a local user. Mitigation Not applicab...
CVE-2026-73427
Trix (rich-text editor) is vulnerable before version 2.1.18 to a cross-site scripting flaw via a crafted application/x-trix-document JSON payload dropped into an editor using the fallback Level0InputController (e.g., embedded WebView without Input Events Level 2 support). The StringPiece.fromJSON...