CVE-2026-119762

Axigen Mail Server versions before 10.5.69 , 10.6.x before 10.6.40 , and 10.7.x before 10.7.2 are vulnerable to an unauthenticated denial of service (DoS) . The root cause is unbounded nesting depth during the parsing of SOAP/XML and JSON request bodies before authentication. An attacker can send...

CVE-2026-119762 Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests

Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request t...

CVE-2026-119762 Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests

Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request t...

CLEANSTART-2026-IC65897 flatted is a circular JSON parser

Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...

CLEANSTART-2026-KQ76880 flatted is a circular JSON parser

Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...

OWASP__json-sanitizer_CVE-2020-13973_1-2-0

json-sanitizer Given JSON-like content, The JSON Sanitizer converts it to valid JSON. Getting Started - Contact This can be attached at either end of a data-pipeline to help satisfy Postel's principle: be conservative in what you do, be liberal in what you accept from others Applied to JSON-like...

CVE-2026-61730

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated /scoutsuite-report StaticFiles mount in backend/copilot.py exposes the scoutsuite-report directory even though normal /api routes require JWT...

CVE-2026-119658

PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve...

CVE-2026-85473

A flaw was found in auth0/java-jwt. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a JSON Web Token JWT containing an out-of-range timestamp claim. Because the issue occurs during token parsing before cryptographic signature verification, processing these malforme...

CVE-2026-118238 CVE-2026-118238

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdu...

CVE-2026-118238

The Tenda W18E High-Power AP is vulnerable to OS command injection in its web management server (/bin/httpd) via the diagnose packet-capture feature. The vulnerability occurs because the formSetNetCheckTools function fails to validate shell metacharacters in the protocol and targetDevice JSON fie...

CVE-2026-118238 CVE-2026-118238

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdu...

GHSA-JPXQ-7H8P-2Q76 joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption

Summary joserfc.jwe.decryptjson, the library's public parser for JWE General JSON Serialization, accepts an attacker-controlled recipients array of unbounded length and performs one full private-key decryption operation decryptcek for every recipient present in the input, with no cap on recipient...

joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption

Summary joserfc.jwe.decryptjson, the library's public parser for JWE General JSON Serialization, accepts an attacker-controlled recipients array of unbounded length and performs one full private-key decryption operation decryptcek for every recipient present in the input, with no cap on recipient...

CLEANSTART-2026-XH36676 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

Security vulnerability affects the activemq package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...

EUVD-2026-113995

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated /scoutsuite-report StaticFiles mount in backend/copilot.py exposes the scoutsuite-report directory even though normal /api routes require JWT...

CVE-2026-112347

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/pageid route and the savepagedata, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware...

CVE-2026-119658

PowerDNS-Admin versions through 2026.08.1 are vulnerable to an authorization bypass via the /domain//update endpoint. The flaw allows authenticated User-role accounts to refresh secondary zones they are not authorized to access by providing a different domain field in the JSON request body. This ...

CVE-2026-119658 PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/<domain_name>/update

PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve...

CVE-2026-119658 PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/<domain_name>/update

PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve...