CVE-2025-65881

CVE-2025-65881 The Project Zoo Management System v1.00 is vulnerable to Cross-site scripting XSS on /zms/classes/Login.php?f=login due to: 1. Invalid Content-type of JSON Responses on /zms/classes/Login.php?f=login 2. Unsanitized User Input in Responses Allowing unauthenticated attackers to injec...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

SUSE CVE-2026-95115

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser...

PYSEC-2026-4213 Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Summary docling accepts serialized DoclingDocument JSON as an input format InputFormat.JSONDOCLING, enabled by default. A crafted JSON file can set a picture's image uri to a local file path. When the converted document is exported with embedded images ImageRefMode.EMBEDDED, the CLI default for...

CVE-2026-102461

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the uniqueItems keyword validation uses an On² pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes...

io.strimzi:kafka-bridge (>=1.2.0-rc1, <=1.2.0), io.vertx:vertx-openapi (5.2.0) +5 more potentially affected by CVE-2026-102461 via io.vertx:vertx-json-schema (5.2.0)

io.vertx:vertx-json-schema MAVEN version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-json-schema and may be impacted: - io.strimzi:kafka-bridge =1.2.0-rc1, =1.2.0 - io.vertx:vertx-openapi 5.2.0 - io.vertx:vertx-stack-depchain...

CVE-2026-102461

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the uniqueItems keyword validation uses an On² pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes...

EUVD-2026-101933

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the uniqueItems keyword validation uses an On² pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes...

cc.openxiot:resty (>=0.0.1, <=0.0.23), cc.unitmesh:connection-manager (>=0.3.3, <=0.3.4) +71 more potentially affected by CVE-2026-102461 via io.vertx:vertx-json-schema (>=4.0.0, <=4.5.34)

io.vertx:vertx-json-schema MAVEN version =4.0.0, =0.0.1, =0.3.3, =v0.27.12, =2.2.9, =2.3.1, =3.0.0-b1, =3.0.0-b4, =0.1, =3.0.4, =3.3.3 and more Source cves: CVE-2026-102461 Source advisory: MEND:CVE-2026-102461...

CVE-2026-102461

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the uniqueItems keyword validation uses an On² pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes...

CVE-2026-102461

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the uniqueItems keyword validation uses an On² pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes...

dev.vertique:vertique-mcp-server (>=0.2.0, <=0.3.0), dev.vertique:vertique-rest-openapi-docs (0.3.0) +22 more potentially affected by CVE-2026-102461 via io.vertx:vertx-json-schema (>=5.1.2, <=5.1.9)

io.vertx:vertx-json-schema MAVEN version =5.1.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =5.0.4, =4.0.0, =4.0.0, =4.0.0, =4.0.2 and more Source cves: CVE-2026-102461 Source advisory: MEND:CVE-2026-102461...

CVE-2026-102461

Eclipse Vert.x versions [4.0.0, 4.5.34] , [5.0.0, 5.0.12] , [5.1.0, 5.1.9] , and [5.2.0, 5.2.0] are vulnerable to a denial of service (DoS) attack. The root cause is located in the io.vertx:vertx-json-schema component, where the uniqueItems keyword validation employs an O(n²) pairwise comparison ...

CVE-2026-102461

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the uniqueItems keyword validation uses an On² pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes...

Security update for the Java stack

This update for Java fixes the following issues: This update introduces new libraries and refines existing Java tools to improve security, compatibility, stability, and formatting. ant Updated to version 1.10.18: Security issues fixed: CVE-2021-36374: Fixed excessive memory allocation when readin...

SUSE-SU-2026:4677-1 Security update for the Java stack

This update for Java fixes the following issues: This update introduces new libraries and refines existing Java tools to improve security, compatibility, stability, and formatting. ant Updated to version 1.10.18: - Security issues fixed: - CVE-2021-36374: Fixed excessive memory allocation when...

CLEANSTART-2026-WY72170 jackson-databind binds a JSON string to a javax

CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...

PT-2026-114977

Name of the Vulnerable Software and Affected Versions jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13 Description An issue exists where attackers can cause a denial of service by providing deeply nested JSON input to an application that deserializes untrusted JSON using the...

EUVD-2026-102127

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...

CVE-2026-95155

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...