mcpsnoop v0.14.0

Wireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal. The problem The official MCP Inspector connects as its own client, so it never sees what your client Cursor, Claude Code, Codex actually sends your server. An...

PT-2026-65813

Name of the Vulnerable Software and Affected Versions cJSON versions prior to 1.7.20 Description The issue involves uncontrolled recursion in the cJSONUtils ApplyPatches and cJSONUtils ApplyPatchesCaseSensitive functions. When an untrusted RFC 6902 JSON Patch is applied, an attacker can use add a...

PT-2026-65814

Name of the Vulnerable Software and Affected Versions cJSON versions prior to 1.7.20 Description An inefficient algorithmic complexity flaw exists in the cJSON Compare function. When comparing objects, the function recurses into each shared subtree twice without a depth guard, resulting in...

PT-2026-64981

Name of the Vulnerable Software and Affected Versions sqlite version 3.41 Description A use-after-free issue exists in the JSON parsing logic. This occurs when a remote adversary provides a specially crafted JSON payload that triggers a memory free followed by illegal memory access. This conditio...

PT-2026-65815

Name of the Vulnerable Software and Affected Versions cJSON versions prior to 1.7.20 Description The apply patch function in cJSON Utils.c performs RFC 6902 JSON Patch operations non-atomically. When a replace operation lacks a value member or a move operation has an unresolvable destination path...

SQL Injection

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to SQL Injection in the json field enrichment process. An attacker can access unauthorized data, execute arbitrary JavaScript on the database server, perform cross-collection queries, or modify and...

Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

Summary Budibase's MongoDB query execution endpoint POST /api/v2/queries/:queryId is vulnerable to NoSQL injection through user-supplied query parameters. The enrichContext function interpolates parameter values into JSON query templates using Handlebars with noEscaping: true, then parses the...

GO-2026-5684 Go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth in github.com/ipld/go-ipld-prime

Go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth in github.com/ipld/go-ipld-prime...

EUVD-2026-42625

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout...

GHSA-855V-HQ7W-JMJW Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Summary With Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perfor...

Insufficient Session Expiration

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Insufficient Session Expiration in the realtime authentication process. An attacker can maintain unauthorized access to realtime features by using a JWT that has been revoked via sign-out or back-channel...

cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag

The function ext.NativeTypesParseStructTag"json" does not honour the encoding/json skip directive json:"-". Fields tagged json:"-" are registered in the CEL type system under the literal name "-" and are readable from any user-submitted CEL expression via dynobj"-". Additionally, newNativeTypes...

K000162435: Spring Data REST vulnerability CVE-2026-41728

Security Advisory Description Spring Data REST's JSON Patch application/json-patch+json implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16;...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview seroval is a Stringify JS values Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' in the fromJSON process. An attacker can achieve unintended server-side invocation and potentially execute arbitrary code by supplying speciall...

Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF

Summary Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — unvalidated on kiota client generate / kiota plugin generate. A repository or pull request containing a malicious...

CVE-2026-65709

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke...

CVE-2026-65709 sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke...

CVE-2026-65709

CVE-2026-65709 concerns sysPass up to version 3.2.11, with a missing object-level authorization vulnerability in the JSON-RPC API. The issue allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access checks. ...

OESA-2026-3174 buildah security update

The package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a new image...

OESA-2026-3176 buildah security update

The package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a new image...