CLEANSTART-2026-JG81275 Serialize JavaScript to a superset of JSON that includes regular expressions and functions

Security vulnerability affects the argo-workflows package. Serialize JavaScript to a superset of JSON that includes regular expressions and functions...

CLEANSTART-2026-DK54299 flatted is a circular JSON parser

Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...

CLEANSTART-2026-CE66026 flatted is a circular JSON parser

Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...

CVE-2026-115274

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer liter...

UBUNTU-CVE-2026-115274

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer liter...

CVE-2026-115274 Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer liter...

EUVD-2026-113758

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer liter...

CVE-2026-115274

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer liter...

cve-2025-1550

cve-2025-1550 keras model json rce...

CLEANSTART-2026-OY52203 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

Security vulnerability affects the sonarqube package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...

CLEANSTART-2026-FS10758 jackson-databind binds a JSON string to a javax

Security vulnerability affects the sonarqube package. jackson-databind binds a JSON string to a javax...

CVE-2026-110732

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin is vulnerable to Missing Authorization in versions up to and including 3.8.6 . The issue stems from the MCP module's OAuth 2.1 Dynamic Client Registration endpoint (/wp-json/mcp/v1/oauth/register) using a permission_callback of ...

usbrip

usbrip inherited from "USB Ripper", not "USB R.I.P." is a simple forensics tool with command line interface that lets you keep track of USB device artifacts i.e., USB event history on Linux machines. Table of Contents: Description Quick Start Showcase System Log Structure Dependencies deb pip...

CLEANSTART-2026-OM88391 jackson-databind binds a JSON string to a javax

Security vulnerability affects the sonarqube package. jackson-databind binds a JSON string to a javax...

PT-2026-133558

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/page id route and the save page data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middlewar...

CVE-2026-55613: openwrt uhttpd: uhttpd is a small HTTP server

uhttpd is a small HTTP server. In unpatched repository snapshots, uhubusdatasend in ubus.c can desynchronize HTTP request boundaries when a POST /ubus JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets du-jsobj; a later segment takes the existing-object...

Important: perl-Cpanel-JSON-XS

Issue Overview: Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees tha...

PT-2026-133480

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped json encode output. Attackers can send crafted index or value parameters with operation=save setting value to /database/designer to overwrite other...

PT-2026-134462

Name of the Vulnerable Software and Affected Versions Product Filter for WooCommerce by WBW versions prior to 3.4.7 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user...

Rocky Linux 8 [CIQ] Security Update: apache-commons-collections / apache-commons-lang / etc Multiple Vulnerabilities (crlsa-2026_90909)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202690909 advisory. com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing CVE-2026-894...