Fedora 43 : perl-Cpanel-JSON-XS (2026-4447e52d23)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4447e52d23 advisory. Current upstream release, with multiple security fixes, updates for performance and correctness. Tenable has extracted the preceding description blo...

CVE-2026-115801

A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hiddendim/classnum results in out-of-bounds read...

CVE-2026-115801 Kakao khaiii JSON Config File Linear.cpp open out-of-bounds

A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hiddendim/classnum results in out-of-bounds read...

CVE-2026-115801 Kakao khaiii JSON Config File Linear.cpp open out-of-bounds

A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hiddendim/classnum results in out-of-bounds read...

CVE-2026-115801 Kakao khaiii JSON Config File Linear.cpp open out-of-bounds

A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hiddendim/classnum results in out-of-bounds read...

CVE-2026-115801

A security flaw exists in Kakao khaiii up to version 0.4 within the JSON Config File Handler component. Specifically, the khaiii::nn::Linear::open function in src/main/cpp/khaiii/nn/Linear.cpp is vulnerable to an out-of-bounds read when the hidden_dim/class_num argument is manipulated. This vulne...

GHSA-MHF7-XP6R-6QRC Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

Impact Three issues allowed actions protected by the Authorize attribute to run against records the current user is not authorized for: 1. Out-of-order parameter keys on actions. Authorize resolved a model parameter by its array key, while the action itself received parameters positionally. A...

Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

Impact Three issues allowed actions protected by the Authorize attribute to run against records the current user is not authorized for: 1. Out-of-order parameter keys on actions. Authorize resolved a model parameter by its array key, while the action itself received parameters positionally. A...

RHLW-2026-4D628364A5512412 Lightwell Security Advisory: nimbus-jose-jwt 9.7.0.rhlw-00004

Red Hat Lightwell has released com.nimbusds:nimbus-jose-jwt 9.7.0.rhlw-00004 with a backported security fix. CVE-2025-53864: Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in...

CVE-2026-58497

Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A maliciou...

CVE-2026-58497

Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A maliciou...

EUVD-2026-109090

Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A maliciou...

CVE-2026-115785

An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite ZCS allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a...

EUVD-2026-109079

An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite ZCS allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a...

CVE-2026-115785

An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite ZCS allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a...

CVE-2026-115785 Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address

An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite ZCS allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a...

CVE-2026-115785

The Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.20 are vulnerable to an SMTP command injection vulnerability within the data-source testing functionality. An authenticated user with account options enabled can perform a JSON SOAP request to inject CR/LF sequences into the emailAddr...

CVE-2026-115785 Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address

An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite ZCS allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a...

CVE-2026-114624

The baserCMS website development framework (versions 5.0.0 to 5.3.2 and 5.4.0 to 5.4.2 ) is vulnerable to PHP object injection . The widget-area entity fails to validate input types, allowing a string submitted via the admin JSON API to be stored unchanged. Subsequent entity reads deserialize thi...

CVE-2026-114624

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end...