CVE-2026-118804 Bricks Broken Access Control via query_result Endpoint

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted poststatus and posttype values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/queryresult REST endpoint...

CVE-2026-118804

Bricks Builder version 2.4.3 and earlier is vulnerable to a broken access control flaw. Unauthenticated attackers can exploit the POST /wp-json/bricks/v1/query_result REST endpoint by providing a publicly obtainable nonce and crafted post_status and post_type values within the originalQueryVars p...

CVE-2026-118804 Bricks Broken Access Control via query_result Endpoint

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted poststatus and posttype values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/queryresult REST endpoint...

Go JOSE: Panics in JSON parsing

Summary Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash. Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. Impact Denial of service vulnerability. Any application that parses untrusted JS...

EUVD-2026-110466

Go JOSE: Panics in JSON parsing...

GHSA-VVM8-GF78-28G4 Go JOSE: Panics in JSON parsing

Summary Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash. Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. Impact Denial of service vulnerability. Any application that parses untrusted JS...

CVE-2026-110816 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, renovate, json-server, prism...

GHSA-6PQ8-JHM2-2VCW vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, renovate, json-server, prism...

CVE-2026-116586

A flaw was found in go-jose. A remote attacker could cause a Denial of Service DoS by submitting specially crafted, deeply nested JSON JavaScript Object Notation input to an affected application. When parsing these deeply nested arrays or objects, the system exceeds its stack memory limits,...

SUSE CVE-2026-116586

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

Security update for perl-Cpanel-JSON-XS

This update for perl-Cpanel-JSON-XS fixes the following issues: CVE-2025-40929: integer overflow bsc1249331. CVE-2026-9334: type confusion via duplicate object keys when dupkeysasarrayref is enabled bsc1267546. CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter...

SUSE-SU-2026:4926-1 Security update for perl-Cpanel-JSON-XS

This update for perl-Cpanel-JSON-XS fixes the following issues: - CVE-2025-40929: integer overflow bsc1249331. - CVE-2026-9334: type confusion via duplicate object keys when dupkeysasarrayref is enabled bsc1267546. - CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filt...

CVE-2026-15323 Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload

The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the processcheckout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the serve...

CVE-2026-15323 Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload

The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the processcheckout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the serve...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the resolveAndValidateGeneric and validateTypeParameter methods of the DatabindContext class. An attacker can instantiate arbitrary classes by supplying a class-name type ID whose generic arguments o...

CLEANSTART-2026-EH26005 Ruby JSON is a JSON implementation for Ruby

Security vulnerability affects the ruby package. Ruby JSON is a JSON implementation for Ruby...

Bricks Builder authorization issue vulnerability

Bricks Builder versions 2.4.3 and earlier contain an authorization issue vulnerability. This vulnerability stems from improper access control; unauthenticated attackers can use publicly available nonces to submit specially crafted poststatus and posttype values via the POST...

CVE-2026-118804: Bricks Bricks Builder: Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to…

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted poststatus and posttype values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/queryresult REST endpoint...

CVE-2026-118642: n8n-io n8n: n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated…

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline...

WordPress Cozy Blocks cross-site scripting vulnerability

WordPress Cozy Blocks versions 2.2.27 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and output escaping for the content parameter icon.view/icon.layout/icon.gap, allowing authenticated attackers with contributor or higher privileges...