CVE-2026-15195: Improperly Controlled Modification of Object Prototype Attributes

A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched...

CVE-2026-9027: Improper Verification of Cryptographic Signature

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Payment Bypass via Improper Verification of Cryptographic Signature in all versions up to, and including, 2.7.4. The corvuspaysuccesshandler function registers the REST endpoint POST /wp-json/corvuspay/success/ with...

PT-2026-56884

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.9.x Description When Redis is configured, the authentication process for Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket first-message uses the decode token function withou...

SUSE SLES15 Security Update : perl-Cpanel-JSON-XS (SUSE-SU-2026:2782-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2782-1 advisory. This update for perl-Cpanel-JSON-XS fixes the following issues - CVE-2026-9334: type confusion via duplicate object keys when dupkeysasarrayref...

openSUSE 16 Security Update : jq (openSUSE-SU-2026:21248-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21248-1 advisory. - CVE-2025-48060: improper handling of string data in jvstringempty can lead to heap buffer overflow and a crash when processing crafted input...

EUVD-2026-42444

Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.0 before 2.36.1 and from 3.0.0 before 3.2.0, the uxicon Twig function is marked issafe='html' and Icon::toHtml inlines SVG source verbatim, allowing unsanitized local SVG files or Iconify on-demand JSON body responses containing nested...

MAL-2026-6988 Malicious code in @vite-tab/tab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95af865d1cf7d45f2b4c2a73eebcfcd1a1a6aba9a36f33bf8256ef4d7235903c @vite-tab/tab republishes Vite's codebase under a different name while impersonating the upstream project: package.json declares bin: vite:...

CVE-2025-9403 affecting package jq for versions less than 1.7.1-8

CVE-2025-9403 affecting package jq for versions less than 1.7.1-8. A patched version of the package is available...

jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution

A flaw was found in jackson-databind, a library used for processing JSON data. This vulnerability allows a remote attacker to force the application to perform an attacker-chosen DNS Domain Name System query. This occurs when untrusted JSON input containing specific network address information is...

Malicious Package

Overview vite-json-pwa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in vite-json-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f9204782dfa050ba762ce8c8a35c01e9f7b1e8bf82e140854d182f9614080b6 [email protected] impersonates the legitimate vite-plugin-pwa package author metadata claims 'inna voik' while funding/homepage point at the real...

MAL-2026-6969 Malicious code in vite-json-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f9204782dfa050ba762ce8c8a35c01e9f7b1e8bf82e140854d182f9614080b6 [email protected] impersonates the legitimate vite-plugin-pwa package author metadata claims 'inna voik' while funding/homepage point at the real...

ROS-20260708-73-0050

The vulnerability of the jq JSON processing tool lies in the use of a hash function that does not meet security requirements. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information or cause service failures...

PT-2026-56445

Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: , allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token...

PT-2026-57869

Name of the Vulnerable Software and Affected Versions Lorex 2K Indoor Wi-Fi Security Camera affected versions not specified Description Network-adjacent attackers can execute arbitrary code with root privileges on affected installations without requiring authentication. The issue occurs during th...

IBM WebSphere Application Server Liberty 17.0.0.3 < 26.0.0.8 DoS (7279284)

The version of IBM WebSphere Application Server Liberty running on the remote host is affected by a DoS vulnerability as referenced in the 7279284 advisory. - In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number...

The vulnerability in the org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator component of the Apache Kafka messaging broker allows a attacker to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator class in the Apache Kafka messaging broker is related to incorrect validation of specified indexes, positions, or offsets in input data. Exploiting this vulnerability could allow an attacker to bypass securi...

Important: oci-seccomp-bpf-hook security update

OCI Hook to generate seccomp json files based on EBF syscalls used by container oci-seccomp-bpf-hook provides a library for applications looking to use the Container Pod concept popularized by Kubernetes. Security Fixes: net: golang: Go net package: Denial of Service via long CNAME response in...

CVE-2026-55417

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route /username correctly returns 404. However, the /json AJAX listing endpoint does not apply the same check. An...

json-flattener:AdvancedFuzzer: Security exception in com.google.gson.internal.bind.TypeAdapters$28.write

Project: https://github.com/wnameless/json-flattener.git Detailed Report: https://oss-fuzz.com/testcase?key=5258667411439616 Project: json-flattener Fuzzing Engine: libFuzzer Fuzz Target: AdvancedFuzzer Job Type: libfuzzerasanjson-flattener Platform Id: linux Crash Type: Security exception Crash...