EUVD-2026-88465

Authlib: empty signatures validation in JWS JSON deserialization...

Server Technology PRO3X port_mux listener override root RCE

Authenticated JSON-RPC setConfiguration overrides protolistener program to /bin/sh; TCP connect triggers execv as root. """Server Technology PRO3X portmux listener program override root RCE.""" from future import annotations import json import re import socket from kittysploit import from...

ubuntu-security-notices

Ubuntu Vulnerability Data This repository contains Ubuntu Vulnerability Data in 3 different JSON formats: 1. The USN/LSN JSON format as generated by the Ubuntu Security Team, we do not advise using this format as it can be changed at any time to fit the team's needs. 2. OSV JSON format, for more...

EUVD-2026-110481

flatcc through 0.6.4 contains an out-of-bounds read vulnerability in flatccjsonparsernumber that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing...

Model Context Protocol MCP Python SDK server request forgery vulnerability

Versions 1.10.0 through 1.30.0 and 2.0.0 through 2.2.0 of the Model Context Protocol MCP Python SDK contain a server-side request forgery vulnerability. This vulnerability arises because ClientSession, ClientSessionGroup, and Client invoke the default JSON schema parser to validate the outputSche...

Linux Distros Unpatched Vulnerability : CVE-2026-65631

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the JSON parsing process. An attacker can cause the application to crash by submitting deeply nested arrays or objects, leading to stack exhaustion. Remediation There is no fixed version for...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the JSON parsing process. An attacker can cause the application to crash by submitting deeply nested arrays or objects, leading to stack exhaustion. Remediation Upgrade github.com/go-jose/go-jose/v4/json t...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the JSON parsing process. An attacker can cause the application to crash by submitting deeply nested arrays or objects, leading to stack exhaustion. Remediation There is no fixed version for...

CVE-2026-116733

flatcc through 0.6.4 contains an out-of-bounds read vulnerability in flatccjsonparsernumber that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing...

AZL-112001 CVE-2026-116586 affecting package keda 2.14.1-19

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

AZL-112049 CVE-2026-116586 affecting package libcontainers-common 20240213-3

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

DEBIAN-CVE-2026-116586

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

AZL-111971 CVE-2026-116586 affecting package influxdb 2.7.5-23

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

AZL-111685 CVE-2026-116586 affecting package cri-o 1.30.1-1

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

AZL-111962 CVE-2026-116586 affecting package ignition-flatcar 2.22.0-7

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

AZL-112244 CVE-2026-116586 affecting package telegraf 1.31.0-36

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

AZL-111905 CVE-2026-116586 affecting package dcos-cli 1.2.0-22

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

AZL-111808 CVE-2026-116586 affecting package azcopy 10.25.1-10

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

AZL-112034 CVE-2026-116586 affecting package kubernetes 1.30.10-32

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...