Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent fixes the following issues CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary...

SUSE-SU-2026:2801-1 Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent fixes the following issues - CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary...

SUSE CVE-2026-9516

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

CVE-2026-9516

A flaw was found in Cpanel::JSON::XS, a Perl module used for processing JSON data. This vulnerability allows a remote attacker to cause a denial of service DoS by providing specially crafted input that begins with a UTF-8 Byte Order Mark BOM. When a decode filter callback encounters an error with...

UBUNTU-CVE-2026-9516

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

CVE-2026-9516 Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

CVE-2026-9516

CVE-2026-9516 affects Cpanel::JSON::XS for Perl prior to 4.41. A UTF-8 BOM prefixed input with a throwing decode filter callback can cause the decoder to skip restoration of the input pointer, leaving the scalar with an offset pointer. When the scalar is freed, the allocator may receive an invali...

CVE-2026-9516

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

CVE-2026-9516 Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

Cpanel::JSON::XS 安全漏洞

Cpanel::JSON::XS is a tool developed by RURBAN personal developers that converts Perl data structures into JSON format. Versions of Cpanel::JSON::XS prior to version 4.41 contained security vulnerabilities. These vulnerabilities stemmed from exceptions thrown during the decoding filter callback,...

PT-2026-45892

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.41 Description An issue exists where providing input prefixed with a UTF-8 Byte Order Mark BOM can lead to a denial of service. When the decode json function processes a 3-byte UTF-8 BOM, it advances the...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: packer, argo-events, amazon-ssm-agent-fips, kots, zarf-fips, commercial-chainloop-cli, gitlab-runner, kubevela-fips, k9s, pulumi, kaniko, packer-fips, trufflehog-fips, flux-fips, skaffold, gptscript, google-osconfig-agent, src-fingerprint-fips, kaniko-fips, trivy,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: packer, argo-events, amazon-ssm-agent-fips, kots, zarf-fips, commercial-chainloop-cli, gitlab-runner, kubevela-fips, k9s, pulumi, kaniko, packer-fips, trufflehog-fips, flux-fips, skaffold, gptscript, google-osconfig-agent, src-fingerprint-fips, kaniko-fips, trivy,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: packer, argo-events, amazon-ssm-agent-fips, kots, zarf-fips, commercial-chainloop-cli, gitlab-runner, kubevela-fips, k9s, pulumi, kaniko, packer-fips, trufflehog-fips, flux-fips, skaffold, gptscript, google-osconfig-agent, src-fingerprint-fips, kaniko-fips, trivy,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, gitlab-runner, crossplane, flux-image-automation-controller, guac, chezmoi, nfpm, flux-source-controller, pulumi-language-dotnet, kots, src-fingerprint, k9s, kubevela, snyk-cli, trivy, zarf, kargo, xeol, wolfictl, argocd-image-updater, tfse...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: external-secrets-operator, gitlab-runner, crossplane, flux-image-automation-controller, guac, chezmoi, nfpm, flux-source-controller, pulumi-language-dotnet, kots, src-fingerprint, k9s, kubevela, snyk-cli, trivy, zarf, kargo, xeol, wolfictl, argocd-image-updater, tfse...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, gitlab-runner, crossplane, flux-image-automation-controller, guac, chezmoi, nfpm, flux-source-controller, pulumi-language-dotnet, kots, src-fingerprint, k9s, kubevela, snyk-cli, trivy, zarf, kargo, xeol, wolfictl, argocd-image-updater, tfse...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: grafana-image-renderer, prometheus, ferretdb, azure-ipam, gogatekeeper, datadog-operator, step-ca, nats-top, spqr, crossplane-provider-aws-ec2, nri-redis, bank-vaults, docker-machine-driver-linode, newrelic-k8s-metadata-injection, nginx-prometheus-exporter, task, frp...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: grafana-image-renderer, prometheus, ferretdb, linkerd2-proxy-init, azure-ipam, gogatekeeper, datadog-operator, step-ca, nats-top, shfmt, spqr, crossplane-provider-aws-ec2, nri-redis, bank-vaults, velero, docker-machine-driver-linode, newrelic-k8s-metadata-injection,...

CVE-2025-27379

A stored cross-site scripting XSS vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content...