PT-2026-66527

SQLite 3.41 is vulnerable to use after free in the jsonExtractFunc function. Premature release of parsed JSON object memory leads to subsequent illegal access of freed pointer. Remote attackers can trigger this flaw via specially crafted SQL queries, resulting in service crash and sensitive memor...

CVE-2026-61536: Improper Control of Generation of Code

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of % completion % blocks and later resolves their importpath field through importlib.importmodule... + getattr... to obtain the callable that...

EUVD-2026-51251

SQLite 3.41 is vulnerable to use after free in the jsonExtractFunc function. Premature release of parsed JSON object memory leads to subsequent illegal access of freed pointer. Remote attackers can trigger this flaw via specially crafted SQL queries, resulting in service crash and sensitive memor...

CVE-2026-67216

A flaw was found in cJSON. An inefficient algorithmic complexity flaw in the cJSONCompare function allows a remote attacker to cause a denial of service DoS. By providing specially crafted, deeply nested JSON JavaScript Object Notation objects for comparison, an attacker can consume excessive CPU...

CVE-2026-67432 MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticated remote attacker to exhaust process...

CVE-2026-67432 MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticated remote attacker to exhaust process...

CVE-2026-67432

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticated remote attacker to exhaust process...

CVE-2026-67432

CVE-2026-67432 affects the MCP Ruby SDK before version 0.23.0. The vulnerability exists in MCP::Server::Transports::StreamableHTTPTransport of the mcp gem, which reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticated remote attacker to exhaust memory on th...

CVE-2026-62995

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

CVE-2026-62995 joserfc accepts JWT with padding, leading to JWT malleability

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

EUVD-2026-50450

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

CVE-2026-62995

CVE-2026-62995 affects the Python library joserfc (versions ≤ 1.7.1). The issue: joserfc accepts JWTs with trailing padding (==), which is non-conforming to JOSE specs and enables JWT malleability when parsed by the library. Practical impact varies by deployment and could allow bypass of token re...

CVE-2026-62995 joserfc accepts JWT with padding, leading to JWT malleability

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

CVE-2026-49844

A flaw was found in Apache Log4j API. This vulnerability occurs due to improper encoding of non-finite floating-point values during JSON serialization of MapMessages, leading to invalid JSON output. An attacker who can supply a non-finite value can exploit this to cause the affected logging layou...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive process. An attacker can cause stack exhaustion and crash the process by supplying a specially crafted RFC 6902 JSON Patch document...

Incorrect Behavior Order

Overview Affected versions of this package are vulnerable to Incorrect Behavior Order through the applypatch process. An attacker can cause unintended deletion of addressable members in the target document by supplying a specially crafted patch document that triggers a replace operation missing i...

CVE-2026-67215

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...

CVE-2026-67217

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

AZL-94410 CVE-2026-67215 affecting package apparmor 3.1.7-1

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...

AZL-94437 CVE-2026-67215 affecting package libglvnd 1.7.0-3

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...