60459 matches found
Denial-of-service (DoS)
github.com/luskaner/agelanserver/server is vulnerable to a denial-of-service DoS. The vulnerability is due to the lack of request body size limits and validation of the attacker-controlled JSON array length, which allows a remote unauthenticated attacker to trigger excessive memory allocation by...
CLEANSTART-2026-AK31970 stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint
Security vulnerability affects the n8n package. stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint...
CLEANSTART-2026-ME44446 stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint
Security vulnerability affects the n8n package. stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint...
CLEANSTART-2026-EJ44011 stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint
Security vulnerability affects the n8n package. stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint...
CLEANSTART-2026-XX88554 undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON
Security vulnerability affects the n8n package. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON...
CLEANSTART-2026-DL13850 PyJWT is a Python implementation of JSON Web Token standards
CVE-2026-102269 affects multiple packages. PyJWT is a Python implementation of JSON Web Token standards. See references for individual vulnerability details...
CLEANSTART-2026-GJ26931 PyJWT is a Python implementation of JSON Web Token standards
CVE-2026-102272 affects multiple packages. PyJWT is a Python implementation of JSON Web Token standards. See references for individual vulnerability details...
CLEANSTART-2026-ON24571 jackson-databind binds a JSON string to a javax
CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...
CLEANSTART-2026-OB90229 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON
Security vulnerability affects the apache-nifi package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...
CLEANSTART-2026-HQ66440 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)
Security vulnerability affects the apache-nifi package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...
PT-2026-117914
Security vulnerability affects the n8n package. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON...
PT-2026-117714
Security vulnerability affects the n8n package. stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint...
PT-2026-117796
Security vulnerability affects the n8n package. stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint...
PT-2026-117770
Security vulnerability affects the apache-nifi package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...
PT-2026-117814
Security vulnerability affects the apache-nifi package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...
PT-2026-117743
Security vulnerability affects the n8n package. stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint...
CVE-2026-91136: Improper Limitation of a Pathname to a Restricted Directory
The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...
spring-break_cve-2017-8046
spring-breakcve-2017-8046 Este es un programa Java que explota la vulnerabilidad Spring Break CVE-2017-8046. Este software está escrito para tener la menor cantidad de dependencias externas posible. AVISO LEGAL Esta herramienta está destinada a ingenieros de seguridad y profesionales de appsec pa...
GHSA-4JFQ-PMQ9-257H ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service
Summary The AoE3 POST /game/cloud/getFileURL handler in luskaner/ageLANServer's bundled game server decodes an attacker-controlled names JSON array and immediately allocates response storage sized directly from the array's length makei.A, lenreq.Names.Data, with no request body size limit and no...
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service
Summary The AoE3 POST /game/cloud/getFileURL handler in luskaner/ageLANServer's bundled game server decodes an attacker-controlled names JSON array and immediately allocates response storage sized directly from the array's length makei.A, lenreq.Names.Data, with no request body size limit and no...