CVE-2026-114129

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack...

CVE-2026-114129 stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack...

CVE-2026-114129 stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack...

CVE-2026-114129

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack...

CVE-2026-114129

The stream-json micro-library (versions 2.0.0 through 3.7.0 ) is vulnerable to a CPU denial of service due to inefficient algorithmic complexity in the FlexAssembler component. When processing string or regular-expression path filters, the library joins the full key stack on every container start...

@absterrg0/circe (0.0.52), @adithyasak/t3 (>=0.0.39-adi.1, <=0.1.5-adi.1) +31 more potentially affected by CVE-2026-114129 via stream-json (>=3.5.0, <=3.6.0)

stream-json NPM version =3.5.0, =0.0.39-adi.1, =0.0.40, =0.28.5-next.1.g1cbb93286, =0.0.37-nightly.20260907.52, =12.4.0-depup.0, =39.2.0, =0.0.40-synaptic.1, =0.1.16, =0.0.41-nightly.20260909.69, =0.0.43-nightly.20260911.744, =0.0.41, =0.0.52-edge.38659523309.1, =0.0.52-edge.41165096709.1 and mor...

CVE-2026-114129 stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack...

CVE-2026-114123

The D365 F&O MCP Server is vulnerable to unauthenticated access in versions prior to 1.11.0 due to insecure default configurations in the official Azure one-click deployment. The deployment files (infrastructure/azuredeploy.json and infrastructure/main.bicep) default the apiKey to an empty string...

CVE-2026-114123 D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet

D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey...

CVE-2026-114123 D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet

D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey...

CVE-2026-114123 D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet

D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey...

Drupal REST & JSON API Authentication for Drupal authorization issue vulnerability

The Drupal REST & JSON API authentication issue affects Drupal versions from 0.0.0 up to and including version 3.2.0. This vulnerability arises because authentication can be bypassed via alternate paths or channels, potentially leading to unauthorized access...

Exploit for Interpretation Conflict in Wordpress

CVE-2026-63030 + CVE-2026-60137 — WP2Shell Exploit WordPres...

CVE-2026-95117

A flaw was found in jsmn. A remote attacker can exploit a buffer overflow by providing specially crafted JSON input to the parser. Successful exploitation causes the application to crash, resulting in a Denial of Service DoS...

json:parse_bson_fuzzer: Use-of-uninitialized-value in nlohmann::json_abi_v3_12_0::detail::binary_reader<nlohmann::json_abi_v3_12_0::ba

Project: https://github.com/nlohmann/json.git Detailed Report: https://oss-fuzz.com/testcase?key=5520518678380544 Project: json Fuzzing Engine: libFuzzer Fuzz Target: parsebsonfuzzer Job Type: libfuzzermsanjson Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

CVE-2026-114099

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGSPOST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nest...

CVE-2026-114099 Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGSPOST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nest...

CVE-2026-114099 Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGSPOST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nest...

CVE-2026-114099

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGSPOST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nest...

CVE-2026-114099

Coraza versions 3.0.0 before 3.8.1 are vulnerable to a WAF Bypass via a JSON Key Collision . The root cause is a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, causing distinct properties to collide. Unauthenticated attackers ...