CVE-2026-33061 Jexactyl has Stored DOM Cross-Site Scripting (XSS) via unescaped JSON in Blade template

Jexactyl is a customisable game management panel and billing system. Commits after 025e8dbb0daaa04054276bda814d922cf4af58da and before e28edb204e80efab628d1241198ea4f079779cfd inject server-side objects into client-side JavaScript through resources/views/templates/wrapper.blade.php. Using unescap...

EUVD-2026-13622

exactyl is a customisable game management panel and billing system. Commits after 025e8dbb0daaa04054276bda814d922cf4af58da and before e28edb204e80efab628d1241198ea4f079779cfd inject server-side objects into client-side JavaScript through resources/views/templates/wrapper.blade.php. Using unescape...

CVE-2026-32874

A flaw was found in UltraJSON, a fast JSON encoder and decoder. A remote attacker can exploit this vulnerability by providing specially crafted JSON input that contains extremely large integers. When UltraJSON attempts to parse these inputs, it leads to an accumulating memory leak. This excessive...

CVE-2026-33043 AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS

WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated request. The allowOrigin function reflects any Origin header back in Access-Control-Allow-Origin with Access-Control-Allow-Credentials...

Malicious code in json-bundling (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61f19cbc17dc9182ab2266b7b505dedb74da2b797aa6661669f53efd1b86777a The package json-bundling was found to contain malicious code. Source: ghsa-malware debc855dc41e080d6afbfd087c2a01d8d9e5fac885734e59fb2e1adb870d6198...

MAL-2026-1977 Malicious code in json-bundling (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61f19cbc17dc9182ab2266b7b505dedb74da2b797aa6661669f53efd1b86777a The package json-bundling was found to contain malicious code. Source: ghsa-malware debc855dc41e080d6afbfd087c2a01d8d9e5fac885734e59fb2e1adb870d6198...

Malware in json-specular

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in json-bundling

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview json-bundling is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1978 Malicious code in json-specular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21e4ef994911ed1494838bbc4c0f20fb4e194a7e264a9e7014759d9e23466ac9 The package json-specular was found to contain malicious code. Source: ghsa-malware 1bb4124a4b5522f2d7f36098f59a85a760b3e029a30baffafa922a34d2e7a21c...

com.agorapulse:micronaut-amazon-awssdk-dynamodb-loader (>=3.4.3, <=4.2.0), com.agorapulse:micronaut-amazon-awssdk-kinesis (>=3.4.3, <=4.2.0) +476 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=4.0.0-m1, <=4.10.15)

io.micronaut:micronaut-json-core MAVEN version =4.0.0-m1, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.5.1 and more Source cves: CVE-2026-33013 Source advisory: MEND:CVE-2026-33013...

com.agorapulse:gru-micronaut (1.4.0), com.bertramlabs.plugins:asset-pipeline-grails (>=4.5.0, <=4.5.2) +184 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=3.9.0, <=3.10.4)

io.micronaut:micronaut-json-core MAVEN version =3.9.0, =4.5.0, =1.3.6, =1.30.0, =2.14.0, =2.12.0, =1.13.0, =0.1.0, =6.0.9, =6.0.10 - io.github.matrei:grails-inertia-plugin 2.0.0 and more Source cves: CVE-2026-33013 Source advisory: MEND:CVE-2026-33013...

com.agorapulse:micronaut-amazon-awssdk-cloudwatch (>=1.6.1-micronaut-3.0, <=2.2.2-micronaut-3.0), com.agorapulse:micronaut-amazon-awssdk-cloudwatchlogs (>=2.0.8-micronaut-3.0, <=2.2.2-micronaut-3.0) +448 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=3.1.0, <=3.8.12)

io.micronaut:micronaut-json-core MAVEN version =3.1.0, =1.6.1-micronaut-3.0, =2.0.8-micronaut-3.0, =1.6.1-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.2-micronaut-3.0, =2.0.0-micronaut-3.0, =1.7.2-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.1-micronaut-3.0,...

Malicious code in safe-json-parsex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c75827c4ff52be2152687faf186ee7a5668e9dd33bd30adfab490a5e2198c30 The package safe-json-parsex was found to contain malicious code. Source: ghsa-malware 4baa22d0d844650e1fcedcce52b117324903496e0d1399245674b48e4b3ae0...

Malicious Package

Overview safe-json-parsex is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1968 Malicious code in safe-json-parsex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c75827c4ff52be2152687faf186ee7a5668e9dd33bd30adfab490a5e2198c30 The package safe-json-parsex was found to contain malicious code. Source: ghsa-malware 4baa22d0d844650e1fcedcce52b117324903496e0d1399245674b48e4b3ae0...

Malware in safe-json-parsex

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in json-parse-genie

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview json-parse-genie is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1952 Malicious code in json-parse-genie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57744a9f0e3acf081bd2a75ca3684d01e3907f1eab7636e0873ed0ef1bf509ee The package json-parse-genie was found to contain malicious code. Source: ghsa-malware b2293df6ecd418ffd21c1112affa6571afe9a78ff596ce2dd1fac64a470c98...