PT-2026-121307

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue calls readArray and readObject, which call nextValue again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes t...

PT-2026-121366

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi in src/server realtime auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read,...

Oracle MySQL Server 9.x.x < 9.7.4 (October 2026 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Compiling OpenSSL. Supported versions that are affected...

Oracle MySQL Cluster 26.x.x < 26.10.0 (October 2026 CPU)

The versions of MySQL Cluster installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Compiling OpenSSL. Supported versions that are affected...

Oracle MySQL Cluster 8.0.x < 8.0.50 (October 2026 CPU)

The versions of MySQL Cluster installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Compiling OpenSSL. Supported versions that are affected...

Oracle MySQL Cluster 9.x.x < 9.7.4 (October 2026 CPU)

The versions of MySQL Cluster installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Compiling OpenSSL. Supported versions that are affected...

Rocky Linux 10.2 [CIQ] Security Update: cockpit-machines Multiple Vulnerabilities (crlsa-2026_86971)

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686971 advisory. cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Dat...

PT-2026-121347

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/id. Attackers can pass id1 with crafted SQ...

Vaadin android-json resource management error vulnerability

Versions of Vaadin Android JSON prior to 0.0.20131108.1 contain a resource management error vulnerability. This vulnerability arises because the org.json parser lacks depth restrictions on nested structures; as a result, JSONTokener.nextValue recursively calls readArray and readObject. In cases o...

PT-2026-121656

Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting require...

PT-2026-134800

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=575915982 Crash type: Use-of-uninitialized-value Crash state: nlohmann::json abi v3 12 0::detail::binary readernlohmann::json abi v3 12 0::ba nlohmann::json abi v3 12 0::detail::binary readernlohmann::json abi v3 12 0::ba...

PT-2026-121374

Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm spot get json AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to...

Rocky Linux 9 [CIQ] Security Update: cockpit-machines Multiple Vulnerabilities (crlsa-2026_86970)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686970 advisory. cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Data...

CVE-2026-114136

A flaw was found in Django REST framework. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by exhausting server memory. The issue occurs because the JSON parser accepts arbitrary client-supplied charset encodings, including decompression codecs, rathe...

CVE-2026-114457

A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated...

Coraza Body Processor Has A JSON Key Collision That Allows Unauthenticated Attackers To Bypass OWASP CRS Inspection

Summary Coraza's JSON body processor converts nested JSON properties into dot-separated "ARGSPOST" names without escaping dots contained in literal property names. Two distinct JSON properties can therefore collapse into the same Coraza variable An unauthenticated attacker can place a malicious...

CVE-2026-114129

A flaw was found in stream-json. The FlexAssembler component does not enforce a limit on nesting depth when processing JSON documents configured with path filters. By submitting a crafted document with deeply nested objects or arrays, an attacker can trigger excessive key operations that consume...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

CVE-2026-109619 — PHP jsonencode Use-After-Free via HashT...

CVE-2026-114129

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack...

CVE-2026-114129 stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack...