PT-2026-115293

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create customer mutation to inser...

CVE-2026-95179: Uncontrolled Recursion

An issue in lottie-android 6.7.1 and earlier and master allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer...

WS-2026-0146

@modelcontextprotocol/sdk 1.10.0-1.30.0, @modelcontextprotocol/server and @modelcontextprotocol/node 2.0.0 and prereleases, @modelcontextprotocol/hono 2.0.0 and prereleases: HTTP server transports and handlers put no limit on request body size or JSON-RPC batch length, so an unauthenticated clien...

PT-2026-114963

EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying,...

CVE-2026-95155

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...

PT-2026-114827

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the uniqueItems keyword validation uses an On² pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes...

CVE-2026-63130: Improper Limitation of a Pathname to a Restricted Directory

EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying,...

CVE-2026-95179

The lottie-android library (version 6.7.1 and earlier, including master ) is vulnerable to a Denial of Service (DoS) attack. A remote attacker can trigger this by providing a crafted Lottie animation JSON that contains a cyclic precomposition reference graph . This configuration leads to uncontro...

CVE-2026-95155

The FasterXML Jackson 1.x library is vulnerable to a Denial of Service (DoS) attack, specifically confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13 . The root cause is uncontrolled recursion (CWE-674), where an attacker can supply deeply nested JSON input to an app...

PT-2026-115112

Name of the Vulnerable Software and Affected Versions joserfc versions prior to 1.7.4 Description The deserialize json function in the joserfc.jws module incorrectly handles JWS General JSON Serialization when the signatures array is empty. The verify general json function fails to perform any...

PT-2026-114979

Name of the Vulnerable Software and Affected Versions kin-openapi versions prior to 0.145.0 Description Loading an attacker-controlled OpenAPI document through LoadFromData, LoadFromFile, or LoadFromURI can cause the loading process to panic. This occurs because the openapi3.Loader can dereferenc...

CVE-2026-102461: Inefficient Algorithmic Complexity

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the uniqueItems keyword validation uses an On² pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes...

CVE-2026-95155

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...

PT-2026-115118

Name of the Vulnerable Software and Affected Versions undici versions 4.0.0 through 6.29.0 undici versions 7.0.0 through 7.30.0 undici versions 8.0.0 through 8.12.1 Description The Agent dispatcher performs a JSON-based deep clone of constructor options before forwarding them to per-origin pools...

CVE-2026-110853 n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON

n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to...

CVE-2026-110853

n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to...

CVE-2026-55383

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailableid without verifying mailabletype,...

CVE-2026-55383

Prior to version 2.4.0 , the InvoiceShelf web & mobile app is vulnerable to a token type confusion issue. The application fails to verify the mailable_type when processing numeric mailable_id values from EmailLog tokens on public routes for invoices, estimates, and payments. Additionally, the JSO...

CVE-2026-55383 InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailableid without verifying mailabletype,...

CVE-2026-55383 InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailableid without verifying mailabletype,...