EUVD-2026-110079

A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this...

CVE-2026-116479

A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this...

CVE-2026-116479 a2aproject a2a-java JSON-RPC Error getMessage information exposure

A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this...

CVE-2026-116479 a2aproject a2a-java JSON-RPC Error getMessage information exposure

A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this...

Security Bulletin: IBM Engineering Systems Design Rhapsody TestConductor was affected by Vulnerability in log4j

Summary Security Bulletin: IBM Engineering Systems Design Rhapsody TestConductor was affected by Vulnerability in log4j. We have addressed this vulnerability in our latest iFix for all versions. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point...

Security Bulletin: A Security Vulnerability in Apache Struts affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-73633)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed this security vulnerability Vulnerability Details CVEID:CVE-2026-73633 DESCRIPTION: Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate...

Security Bulletin: IBM Engineering Systems Design Rhapsody is vulnerable to improper encoding of non-finite floating-point values

Summary Vulnerability of Improper encoding related to Log4j library was addressed for IBM Engineering Systems Design Rhapsody. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API...

OPENSUSE-SU-2026:22187-1 Security update for perl-Cpanel-JSON-XS

This update for perl-Cpanel-JSON-XS fixes the following issues: Changes in perl-Cpanel-JSON-XS: - updated to 4.800.0 4.80 + Security fixes, reported by Stig Palmquist CPANSec: CVE-2026-110672 decode: free the hash key on "Duplicate keys not allowed" and on a missing ':' leak. bsc1286166...

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion

A flaw was found in FasterXML jackson-databind. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing specially crafted JSON input to an application that deserializes it into an identity-enabled collection or map. The flaw occurs due to inefficient processing o...

CVE-2026-111181 vulnerabilities

Vulnerabilities for packages: code-server, thingsboard, json-server, tileserver-gl, kubeflow-centraldashboard, langfuse...

GHSA-27R3-JXMH-P828 vulnerabilities

Vulnerabilities for packages: code-server, thingsboard, json-server, tileserver-gl, kubeflow-centraldashboard, langfuse...

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion

A flaw was found in FasterXML jackson-databind. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing specially crafted JSON input to an application that deserializes it into an identity-enabled collection or map. The flaw occurs due to inefficient processing o...

Agent2Agent A2A Java SDK information disclosure vulnerability

Agent2Agent A2A Java SDK versions 1.2.0.Final and earlier contain an information disclosure vulnerability. This vulnerability stems from improper handling of the getMessage function within the JSON-RPC Error Handler component; it may lead to information leakage via error messages, allowing...

Andrew Bennett JOSE Resource Management error vulnerability

Versions 1.7.7 through 1.11.13 of Andrew Bennett’s JOSE library contain a resource management error vulnerability. This flaw arises from inefficient algorithm complexity and insufficient validation of parameters such as d, e, and n within RSA JSON Web Keys. When parsing specially crafted JWKs, th...

PT-2026-125105

A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this...

Go JOSE resource management error vulnerability

Versions of Go JOSE prior to 4.1.5 contain a resource management error vulnerability. This vulnerability arises when parsing JSON controlled by an attacker; deeply nested arrays or objects exceed Go’s stack limits, leading to a stack overflow and potentially causing a denial of service...

AlmaLinux 9 : grafana (ALSA-2026:54184)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:54184 advisory. grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads CVE-2026-42127 Tenable has extracted the preceding description bloc...

PT-2026-125482

Name of the Vulnerable Software and Affected Versions flatcc versions prior to 0.6.5 Description An out-of-bounds read occurs in the flatcc json parser number function when processing numbers that end with a decimal point. An attacker can provide untrusted JSON data that terminates immediately...

PT-2026-125464

Name of the Vulnerable Software and Affected Versions go-jose versions prior to 4.1.5 Description Parsing attacker-controlled JSON allows deeply nested arrays or objects to exceed the stack limit of the Go language. This results in a stack overflow, which crashes the application and enables a...

CVE-2026-116069

NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local host...