Linux Distros Unpatched Vulnerability : CVE-2026-116586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON W...

PT-2026-129205

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post status and post type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query result REST endpoin...

PT-2026-130623

Name of the Vulnerable Software and Affected Versions Bot for Telegram on WooCommerce versions prior to 1.3.1 Description An authentication bypass exists that allows unauthenticated attackers to take over any account, including administrators, using only a username. The issue occurs because the...

ats-jsonrpc-unrestricted

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · ats-jsonrpc-unrestricted ats-jsonrpc-unrestricted Class: Privilege leftover recon Reach: Local Apache Traffic Server 10.2.0 b1df7334 - Apache Software Foundation JSON-RPC unix socket defaults to restrictedapi false...

rabl-old

RABL RABL Ruby API Builder Language is a Rails and Padrino ruby templating system for generating JSON, XML, MessagePack, PList and BSON. When using the ActiveRecord 'tojson' method, I find myself wanting a more expressive and powerful solution for generating APIs. This is especially true when the...

Updated perl-Cpanel-JSON-XS package fixes security vulnerabilities

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeysasarrayref is enabled. CVE-2026-9334 Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. CVE-2026-9516...

MGASA-2026-0559 Updated perl-Cpanel-JSON-XS package fixes security vulnerabilities

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeysasarrayref is enabled. CVE-2026-9334 Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. CVE-2026-9516...

GHSA-F897-62HF-6GXQ MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length

Summary In affected versions, MCP servers reachable over HTTP put no limit on the size of a POST body or on the number of messages in a JSON-RPC batch. Large requests could exhaust the server's memory, and one long batch could block it from serving anyone else. No credentials were needed, unless...

MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length

Summary In affected versions, MCP servers reachable over HTTP put no limit on the size of a POST body or on the number of messages in a JSON-RPC batch. Large requests could exhaust the server's memory, and one long batch could block it from serving anyone else. No credentials were needed, unless...

Allocation of Resources Without Limits or Throttling

Overview @modelcontextprotocol/server is a Model Context Protocol implementation for TypeScript - Server package Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded HTTP request body reading in the Hono middleware handler. An...

Allocation of Resources Without Limits or Throttling

Overview @modelcontextprotocol/hono is a Hono adapters for the Model Context Protocol TypeScript server SDK - Hono middleware Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded HTTP request body reading in the Hono middleware...

Allocation of Resources Without Limits or Throttling

Overview @modelcontextprotocol/sdk is a Model Context Protocol implementation for TypeScript Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded HTTP request body reading in the Hono middleware handler. An unauthenticated attacker...

Allocation of Resources Without Limits or Throttling

Overview @modelcontextprotocol/node is a Model Context Protocol implementation for TypeScript - Node.js middleware Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded HTTP request body reading in the Hono middleware handler. An...

EUVD-2026-110467

Go JOSE: DoS when parsing JWKs that contain RSA keys...

CVE-2026-65631

Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key. When an application parses an untrusted JWK through the public josejwk:frombinary/1 or josejwk:frommap/1 API or the...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names

A flaw was found in jackson-core. When parsing JSON data from character-based inputs, the parser does not enforce configured property name length limits while reading object keys into memory. A remote, unauthenticated attacker can exploit this flaw by submitting a crafted JSON payload containing ...

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion

A flaw was found in FasterXML jackson-databind. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing specially crafted JSON input to an application that deserializes it into an identity-enabled collection or map. The flaw occurs due to inefficient processing o...

GHSA-763V-5PJM-FX36 Strands Agents: Default FileSessionManager storage is world-readable on shared systems

There is a local confidentiality issue in the default FileSessionManager storage behavior. By default it writes session data under /tmp/strands/sessions and relies on the process umask for directory and file permissions. On systems using the common umask 022, the session directories are 0755 and...

GHSA-6V38-4H7W-RJ9H Authlib: empty signatures validation in JWS JSON deserialization

Authlib prior to 1.9.0 contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key. Root caus...

Authlib: empty signatures validation in JWS JSON deserialization

Authlib prior to 1.9.0 contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key. Root caus...