CLEANSTART-2026-NT71796 undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON

Security vulnerability affects the langfuse package. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON...

CLEANSTART-2026-KK34525 security issue was found in Netplex Json-smart 2

Security vulnerability affects the apache-hive package. A security issue was found in Netplex Json-smart 2...

CLEANSTART-2026-PP78809 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

CLEANSTART-2026-TI30417 jackson-databind binds a JSON string to a javax

CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...

CLEANSTART-2026-KQ19093 flatted is a circular JSON parser

Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...

CLEANSTART-2026-GT01967 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)

CVE-2026-18401 affects multiple packages. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. See references for individual vulnerability details...

CLEANSTART-2026-SB96942 flatted is a circular JSON parser

Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...

PT-2026-102457

Name of the Vulnerable Software and Affected Versions Octopus Server affected versions not specified Description An authenticated user with permissions to edit an Environment or Project can provide specifically crafted JSON content for the object. This leads to insecure deserialization, which...

PT-2026-102707

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.4 Description An unauthenticated path traversal issue exists where the component accepts upload-field state as guest-controlled JSON during public form submission. If the auto-reply and attach uploaded fil...

PT-2026-108524

Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...

Oracle Linux 9 : ruby:4.0 (ELSA-2026-72484)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-72484 advisory. - Fix resolv: do not register on-demand classes for unknown DNS types and SvcParamKeys to prevent memory exhaustion CVE-2026-80212 Resolves: RHEL-252035 - Fix...

CVE-2026-101169: Deserialization of Untrusted Data

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...

CVE-2026-101126: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming...

CVE-2026-102424: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose id merely looks numeric, the...

PT-2026-108446

Security vulnerability affects the apache-hive package. A security issue was found in Netplex Json-smart 2...

PT-2026-108449

Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...

PT-2026-108488

Security vulnerability affects the langfuse package. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON...

Uncontrolled Recursion

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Uncontrolled Recursion via the load method in jwt/apijws.py when parsing a JWT with a deeply nested recursive JSON structure in the header. An attacker can supply a JWT whose header contains...

CVE-2026-102274

A flaw was found in pyjwt. The library fails to properly handle errors when parsing a JSON Web Key JWK set that contains a malformed RSA key alongside valid keys. A remote attacker can supply or inject a malformed key to abort the processing of the entire key set, resulting in authentication...

CVE-2026-102265

A flaw was found in PyJWT. An unauthenticated remote attacker could trigger a Denial of Service DoS condition by supplying a specially crafted JSON Web Token JWT with deeply nested headers during decoding. Processing these nested structures causes an uncaught recursion error that bypasses standar...