PT-2026-118015

Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow process crash in github.com/corazawaf/coraza...

PT-2026-132894

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode tag. With allow tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a...

PT-2026-117582

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description An issue exists in the decode hv function where freed filter callbacks are used when a filter removes itself during the decoding process. The decode process copies the filter json object and...

PT-2026-132896

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max size in incr parse. The parser appends each chunk to its buffer. In scalar or list context, it compares max size with how far it has progressed, not with the buffer length. A chunk that...

PT-2026-118034

ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud getFileURL Endpoint Leads to Remote Denial of Service in github.com/luskaner/ageLANServer/server...

PT-2026-132898

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys as arrayref in decode hv. With dupkeys as arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and eve...

CVE-2026-110688: Inefficient Algorithmic Complexity

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...

PT-2026-118014

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza...

CVE-2026-110676: Asymmetric Resource Consumption (Amplification)

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allowbignum. With allowbignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply...

CVE-2026-110686: Use After Free

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decodehv. A decode copies the parser's filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. A filter callback that removes the last...

CVE-2026-112774: Improper Control of Generation of Code

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout. Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys th...

CVE-2026-110675: Improper Validation of Syntactic Correctness of Input

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...

CVE-2026-110678: Allocation of Resources Without Limits or Throttling

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past maxsize in incrparse. The parser appends each chunk to its buffer. In scalar or list context, it compares maxsize with how far it has progressed, not with the buffer length. A chunk that...

CVE-2026-110684: Missing Release of Memory after Effective Lifetime

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encodestringify. encodestringify writes a value in its string form under allowstringify, under convertblessed for objects without TOJSON, and under allowbignum...

PT-2026-117663

Name of the Vulnerable Software and Affected Versions TP-Link Tapo C210 version 3.60 Description Unauthenticated DS JSON API requests may expose shared credential material and cryptographic metadata. This shared credential can be accepted by the Streamd Digest authentication mechanism as an...

CVE-2026-110685: Missing Release of Memory after Effective Lifetime

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...

TP-Link Tapo C210 authorization issue vulnerability

Versions of TP-Link Tapo C210 prior to build 260818 contain an authorization issue vulnerability. This vulnerability stems from inconsistent application of module-level authorization checks within the DS JSON API. specially crafted JSON requests containing both protected operations and publicly...

PT-2026-117583

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.43 through 4.79 Description An issue exists during canonical encoding in the utf16 cmp function where byte-string keys are misordered. Canonical encoding sorts keys by UTF-16 code units; however, if any key in a has...

PT-2026-132897

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode hv. A decode copies the parser's filter json object and filter json single key object callbacks without taking references to them. A filter callback that removes the la...

PT-2026-117465

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible ssh common args with a ProxyCommand or...