CVE-2026-114644

The MongoDB C# Driver's BSON library is vulnerable to an uncontrolled resource consumption weakness during the deserialization of a specific BSON value type. The root cause involves the library retaining data derived from untrusted content for the entire lifetime of the process without any accumu...

CVE-2026-114644 Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization

The MongoDB C Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no...

CVE-2026-54238 Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed wit...

npm: stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

npm: stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving Odepth^2 CPU denial of service vulnerability discovered by ? in WordPress npm stream-json versions = 2.0.0, = 3.6.0...

stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

Summary FlexAssembler, the custom-container assembler shipped in the stream-json package src/core/utils/flex-assembler.js, re-exported at stream-json/utils/flex-assembler.js and stream-json/web/utils/flex-assembler.js, compiles a string or RegExp path filter into a matcher that runs...

@absterrg0/circe (0.0.52), @adithyasak/t3 (>=0.0.39-adi.1, <=0.1.5-adi.1) +52 more potentially affected by CVE-2026-114129 via stream-json (>=2.0.0, <=3.6.0)

stream-json NPM version =2.0.0, =0.0.39-adi.1, =0.0.40, =0.28.5-next.1.g1cbb93286, =0.0.37-nightly.20260907.52, =12.4.0-depup.0, =39.2.0, =0.0.40-synaptic.1, =0.1.16, =0.0.41-nightly.20260909.69, =0.0.47 - @iflow-mcp/dcostenco-prism-mcp-server 6.2.2 - @jacksondr5/j5code 0.0.43 -...

GHSA-JJ87-HC4R-JWFW stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

Summary FlexAssembler, the custom-container assembler shipped in the stream-json package src/core/utils/flex-assembler.js, re-exported at stream-json/utils/flex-assembler.js and stream-json/web/utils/flex-assembler.js, compiles a string or RegExp path filter into a matcher that runs...

@absterrg0/circe (0.0.52), @adithyasak/t3 (>=0.0.39-adi.1, <=0.1.5-adi.1) +52 more potentially affected by CVE-2026-114129 via stream-json (>=2.0.0, <=3.6.0)

stream-json NPM version =2.0.0, =0.0.39-adi.1, =0.0.40, =0.28.5-next.1.g1cbb93286, =0.0.37-nightly.20260907.52, =12.4.0-depup.0, =39.2.0, =0.0.40-synaptic.1, =0.1.16, =0.0.41-nightly.20260909.69, =0.0.47 - @iflow-mcp/dcostenco-prism-mcp-server 6.2.2 - @jacksondr5/j5code 0.0.43 -...

EUVD-2026-107412

stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving Odepth^2 CPU denial of service...

CVE-2026-115328

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi in src/serverrealtimeauth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modif...

CVE-2022-51021

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/id. Attackers can pass id1 with crafted SQ...

CVE-2026-115328 JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi in src/serverrealtimeauth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modif...

CVE-2026-115328

The JSON-SCADA software, specifically versions before 0.65-alpha , is vulnerable to an SQL injection in the opcApi() function located at src/server_realtime_auth/index.js. This flaw allows authenticated users to inject stacked SQL statements via HistoryReadRequest parameters, such as NodeId.Id, S...

CVE-2026-115328 JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi in src/serverrealtimeauth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modif...

CVE-2026-115328 JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi in src/serverrealtimeauth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modif...

EUVD-2026-108130

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi in src/serverrealtimeauth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modif...

CVE-2026-115328

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi in src/serverrealtimeauth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modif...

CVE-2022-51021 NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/id. Attackers can pass id1 with crafted SQ...

CVE-2022-51021 NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/id. Attackers can pass id1 with crafted SQ...

EUVD-2022-56075

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/id. Attackers can pass id1 with crafted SQ...