CVE-2026-115480 baserCMS: Public Web API mail-form submission bypasses image CAPTCHA

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mailmessages/add/mailContentId.json endpoint accepts submissions without enforcing the form's authcaptcha setting. BcMail\Controller\Api\MailMessagesController::a...

CVE-2026-115480 baserCMS: Public Web API mail-form submission bypasses image CAPTCHA

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mailmessages/add/mailContentId.json endpoint accepts submissions without enforcing the form's authcaptcha setting. BcMail\Controller\Api\MailMessagesController::a...

CVE-2026-115480

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mailmessages/add/mailContentId.json endpoint accepts submissions without enforcing the form's authcaptcha setting. BcMail\Controller\Api\MailMessagesController::a...

CLSA-2026-1792757203 grafana: Fix of 5 CVEs

CVE-2026-33382: cap JSON bodies read by web.Bind at 100 MiB and pre-auth login, signup, password reset and invite bodies at 100 KiB...

Stream-json: FlexAssembler String/RegExp Path Filters Join The Full Key Stack Per Container Start, Giving O(depth^2) CPU

Summary "FlexAssembler", the custom-container assembler shipped in the "stream-json" package "src/core/utils/flex-assembler.js", re-exported at "stream-json/utils/flex-assembler.js" and "stream-json/web/utils/flex-assembler.js", compiles a string or RegExp path "filter" into a matcher that runs...

CVE-2026-55835

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's "report a capture" email on demand this is expected. The /json//report API endpoint CaptureRepor...

CVE-2026-55835

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's "report a capture" email on demand this is expected. The /json//report API endpoint CaptureRepor...

CVE-2026-55835 Lookyloo: Potential sub-system DoS due to parameter missmatch in notification

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's "report a capture" email on demand this is expected. The /json//report API endpoint CaptureRepor...

CVE-2026-55835

The Lookyloo web interface (prior to version 1.39.4 ) is vulnerable to a potential Denial of Service (DoS) on a connected MISP instance . The root cause is a parameter mismatch in the /json//report API endpoint (CaptureReport ), where the email and comment parameters incorrectly overwrite the as_...

CVE-2026-55835 Lookyloo: Potential sub-system DoS due to parameter missmatch in notification

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's "report a capture" email on demand this is expected. The /json//report API endpoint CaptureRepor...

CVE-2026-55835 Lookyloo: Potential sub-system DoS due to parameter missmatch in notification

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's "report a capture" email on demand this is expected. The /json//report API endpoint CaptureRepor...

EUVD-2026-108582

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's "report a capture" email on demand this is expected. The /json//report API endpoint CaptureRepor...

CLEANSTART-2026-LD68799 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)

Security vulnerability affects the sonarqube package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...

CLEANSTART-2026-HD36441 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

PT-2026-122145

Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A maliciou...

Kakao buffer overflow vulnerability

Versions 0.1, 0.2, 0.3, and 0.4 of KAKAO contain a buffer error vulnerability. This vulnerability stems from improper handling of the hiddendim and classnum parameters in the khaiii::nn::Linear::open function within the JSON Config File Handler component, potentially leading to out-of-bounds read...

Zimbra Collaboration Suite input validation error vulnerability

Zimbra Collaboration Suite ZCS versions 10.1.20 and earlier contain an input validation error vulnerability. This vulnerability stems from improper validation of the emailAddress input in the data source test functionality. It allows authenticated regular users to inject CR/LF sequences into SMTP...

PT-2026-122235

A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hidden dim/class num results in out-of-bounds read...

PT-2026-135861

Impact Three issues allowed actions protected by the Authorize attribute to run against records the current user is not authorized for: 1. Out-of-order parameter keys on actions. Authorize resolved a model parameter by its array key, while the action itself received parameters positionally. A...

Linux Distros Unpatched Vulnerability : CVE-2026-114457

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body...