CVE-2026-114099 Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGSPOST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nest...

EUVD-2026-106902

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGSPOST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nest...

EUVD-2026-106186

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable...

EUVD-2026-106134

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable...

EUVD-2026-106024

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-109282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a...

Eugene Lazutkin stream-json resource management error vulnerability

Versions 2.0.0 through 3.7.0 of Stream-JSON contain a resource management error vulnerability. This vulnerability arises because the path filter matcher in FlexAssembler connects the full key stack at the start of each container. As the key stack grows indefinitely with nested objects or arrays, ...

Linux Distros Unpatched Vulnerability : CVE-2026-95115

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser CVE-2026-95115 Note...

OPENSUSE-SU-2026:12217-1 perl-Cpanel-JSON-XS-4.800.0-1.1 on GA media

These are all security issues fixed in the perl-Cpanel-JSON-XS-4.800.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-120732

Name of the Vulnerable Software and Affected Versions stream-json versions 2.0.0 through 3.6.9 Description FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Due to unbounded object or array nesting, a document...

RockyLinux 10 : cockpit-machines (RLSA-2026:86971)

The remote RockyLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:86971 advisory. cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Dat...

RHEL 9 : cockpit-machines (RHSA-2026:86970)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:86970 advisory. Cockpit component for managing libvirt virtual machines. Security Fixes: cockpit-machines: cockpit-machines: Sensitive data exposure via...

Filip Maňas D365 F&O MCP Server configuration error vulnerability

A security vulnerability exists in Filips Maňas D365 F&O MCP Server versions prior to 1.11.0. This vulnerability arises because Azure One-Click Deployment defaults to setting apiKey to an empty value. When APIKEY is not set or is empty, authentication is not performed. Additionally, HTTP listenin...

RockyLinux 9 : cockpit-machines (RLSA-2026:86970)

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:86970 advisory. cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Data...

RHEL 10 : cockpit-machines (RHSA-2026:86971)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:86971 advisory. Cockpit component for managing libvirt virtual machines. Security Fixes: cockpit-machines: cockpit-machines: Sensitive data exposure via...

PT-2026-120225

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious...

SUSE CVE-2026-110672

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when th...

SUSE CVE-2026-110673

Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allowtags in decodetag. With allowtags, "" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not...

SUSE CVE-2026-110674

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeysasarrayref in decodehv. With allowbarekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated k...

SUSE CVE-2026-110675

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...