ezs (>=5.5.0, <=9.3.1), hoppel (0.4.0) +3 more potentially affected by unknown CVE via notevil (>=0.8.1, <=1.3.1)

notevil NPM version =0.8.1, =5.5.0, =1.0.0, =0.1.0, =0.2.0 - piedpiper-middle-out 5.8.1 Source cves: unknown CVE Source advisory: MEND:WS-2020-0043...

jq: stack overflow in module loading on mutual `include`

...

ezs (>=5.5.0, <=9.3.1), hoppel (0.4.0) +3 more potentially affected by unknown CVE via notevil (>=0.8.1, <=1.3.1)

notevil NPM version =0.8.1, =5.5.0, =1.0.0, =0.1.0, =0.2.0 - piedpiper-middle-out 5.8.1 Source cves: unknown CVE Source advisory: MEND:WS-2019-0260...

UBUNTU-CVE-2025-14870

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted JSON payloads due to insufficient input validation...

CVE-2025-14870

CVE-2025-14870 affects GitLab Community and Enterprise Editions. Affected versions are GitLab CE/EE 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. The issue allowed an unauthenticated user to cause a denial of service by sending specially crafted JSON payloads due to insuffic...

CVE-2025-14870

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted JSON payloads due to insufficient input validation...

@cameronhunter/jest-json-schema (2.1.0), @limedocs/core (>=1.0.0-beta.1, <=1.0.0-beta.13) +3 more potentially affected by unknown CVE via url-relative (1.0.0)

url-relative NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on url-relative and may be impacted: - @cameronhunter/jest-json-schema 2.1.0 - @limedocs/core =1.0.0-beta.1, =0.9.0, =0.16.16 Source cves: unknown CVE Source advisory:...

dinky (1.0.0), jasql (0.5.0-beta.0) +2 more potentially affected by unknown CVE via mongo-parse (1.1.0)

mongo-parse NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on mongo-parse and may be impacted: - dinky 1.0.0 - jasql 0.5.0-beta.0 - nqm-common-import =0.0.0, =0.0.0, =0.0.24 Source cves: unknown CVE Source advisory: MEND:WS-2017-0241...

WS-2014-0032

Affected versions of the json-jwt package before 0.6.1 are vulnerable to timing attacks...

WS-2013-0022

Affected versions of the json-jwt package before 0.4.2 are vulnerable to Denial of Service attacks...

WS-2018-0152

The funcster npm module version 0.0.3 and lower, allows remote code execution during deserialization of JSON...

GitLab Enterprise Edition (EE) and GitLab Community Edition (CE) security vulnerabilities

GitLab Enterprise Edition EE and GitLab Community Edition CE are products of the American company GitLab. GitLab Enterprise Edition is a content management system. GitLab Community Edition is a community version of GitLab. There were security vulnerabilities in versions of GitLab CE/EE between 18...

PT-2026-40855

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.5 through 18.9.6 GitLab CE/EE versions 18.10 through 18.10.5 GitLab CE/EE versions 18.11 through 18.11.2 Description An issue exists where an unauthenticated user can cause a denial of service by sending specially...

CVE-2025-14870: Allocation of Resources Without Limits or Throttling

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted JSON payloads due to insufficient input validation...

RockyLinux 9 : jq (RLSA-2026:16693)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:16693 advisory. jq: out-of-bounds read in jvparsesized on error formatting for non-NUL-terminated buffers CVE-2026-39979 jq: jq: Denial of Service via crafted JSON obje...

MongoDB PHP Driver security vulnerabilities

The MongoDB PHP Driver is an open-source driver developed by MongoDB for PHP applications, enabling connection to MongoDB databases. The MongoDB PHP Driver has a security vulnerability that stems from a stack overflow issue when processing deeply nested BSON documents, which may lead to applicati...

RockyLinux 10 : jq (RLSA-2026:16692)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:16692 advisory. jq: out-of-bounds read in jvparsesized on error formatting for non-NUL-terminated buffers CVE-2026-39979 jq: jq: Denial of Service via crafted JSON...

Malicious code in ethers-json-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f3f9028ba781f40a017e081a311983ae2834cdce93583e629952f1f7e29a0677 The OpenSSF Package Analysis project identified 'ethers-json-wallet' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2026-3709 Malicious code in ethers-json-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f3f9028ba781f40a017e081a311983ae2834cdce93583e629952f1f7e29a0677 The OpenSSF Package Analysis project identified 'ethers-json-wallet' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2026-41495

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.11, when n8n-mcp runs in HTTP transport mode, incoming requests to the POST /mcp endpoint had their request metadata written to server logs regardless of the...