crack-0.1.8-fixed

= crack Really simple JSON and XML parsing, ripped from Merb and Rails. The XML parser is ripped from Merb and the JSON parser is ripped from Rails. I take no credit, just packaged them for all to enjoy and easily use. == note on releases Releases are tagged on github and also released as gems on...

EUVD-2026-113951

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/pageid route and the savepagedata, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware...

CVE-2026-112347 Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/pageid route and the savepagedata, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware...

CVE-2026-112347

The Kirki plugin for WordPress (versions before 6.4.1) is susceptible to a broken object-level access control vulnerability in its page REST API. The flaw resides in the PageController.php file, specifically within the save_page_data, duplicate, and delete handlers for the PUT /wp-json/kirki/v1/p...

CVE-2026-112347 Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/pageid route and the savepagedata, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware...

CLEANSTART-2026-ZH33072 Delete function fails to properly validate offsets when processing malformed JSON input

CVE-2026-32285 affects multiple packages. The Delete function fails to properly validate offsets when processing malformed JSON input. See references for individual vulnerability details...

json-sanitizer

json-sanitizer Given JSON-like content, The JSON Sanitizer converts it to valid JSON. Getting Started - Contact This can be attached at either end of a data-pipeline to help satisfy Postel's principle: be conservative in what you do, be liberal in what you accept from others Applied to JSON-like...

CLEANSTART-2026-XO33958 jackson-databind binds a JSON string to a javax

CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...

CVE-2026-116586

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

CLEANSTART-2026-TO29181 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

CLEANSTART-2026-RQ02803 security issue was found in Netplex Json-smart 2

Security vulnerability affects the apache-hive package. A security issue was found in Netplex Json-smart 2...

day01-sessionreaper-lab

Day 1 — SessionReaper-style Vulnerable Lab Educational This is a tiny lab that simulates the core idea reported for CVE-2025-54236 “SessionReaper”: improper validation of nested JSON leading to dangerous code paths. This is not Magento/Adobe Commerce; it's a minimal educational replica to practic...

passfault

Welcome to OWASP Passfault Objective: Do Passwords Better! NOTE: This project has been discontinued, but the zxcvbn project has a very similar approach and has been quite successful. We recommend using that library. Running the Command-line Interface: 1. install java 8 jdk 2. cd commandLine 3...

CLEANSTART-2026-QZ59446 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)

CVE-2026-18401 affects multiple packages. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. See references for individual vulnerability details...

CLEANSTART-2026-WL49761 ajv (Another JSON Schema Validator) before 8

Security vulnerability affects the argo-workflows package. ajv Another JSON Schema Validator before 8...

CLEANSTART-2026-JG81275 Serialize JavaScript to a superset of JSON that includes regular expressions and functions

Security vulnerability affects the argo-workflows package. Serialize JavaScript to a superset of JSON that includes regular expressions and functions...

CLEANSTART-2026-DK54299 flatted is a circular JSON parser

Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...

CLEANSTART-2026-CE66026 flatted is a circular JSON parser

Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...

CVE-2026-115274

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer liter...

UBUNTU-CVE-2026-115274

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer liter...