CVE-2026-9516

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

CVE-2026-9516 Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

CVE-2026-9516: Release of Invalid Pointer or Reference

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

Cpanel::JSON::XS 安全漏洞

Cpanel::JSON::XS is a tool developed by RURBAN personal developers that converts Perl data structures into JSON format. Versions of Cpanel::JSON::XS prior to version 4.41 contained security vulnerabilities. These vulnerabilities stemmed from exceptions thrown during the decoding filter callback,...

PT-2026-45892

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.41 Description An issue exists where providing input prefixed with a UTF-8 Byte Order Mark BOM can lead to a denial of service. When the decode json function processes a 3-byte UTF-8 BOM, it advances the...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: syft, kubescape-server, grafana-alloy-fips, flux-source-controller, argo-workflows-fips, xeol-fips, cloudbeat-fips, grype, jfrog-cli, k9s, chezmoi, trivy-operator-fips, cerbos, kyverno-fips, steampipe, trufflehog-fips, k9s-fips, wolfictl, argo-events-fips,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: syft, kubescape-server, grafana-alloy-fips, flux-source-controller, argo-workflows-fips, xeol-fips, cloudbeat-fips, grype, jfrog-cli, k9s, chezmoi, trivy-operator-fips, cerbos, kyverno-fips, steampipe, trufflehog-fips, k9s-fips, wolfictl, argo-events-fips,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: syft, kubescape-server, grafana-alloy-fips, flux-source-controller, argo-workflows-fips, xeol-fips, cloudbeat-fips, grype, jfrog-cli, k9s, chezmoi, trivy-operator-fips, cerbos, kyverno-fips, steampipe, trufflehog-fips, k9s-fips, wolfictl, argo-events-fips,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: rancher-fleet, snyk-cli, flux, gitsign, argo-cd, crossplane, gomplate, teleport, kaniko, tfsec, scorecard, src-fingerprint, melange, gptscript, trufflehog, flux-source-controller, dagger, trivy-operator, gitaly, argo-workflows, grafana-alloy, guac, kubevela, kyverno,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: rancher-fleet, snyk-cli, flux, gitsign, argo-cd, crossplane, gomplate, teleport, kaniko, tfsec, scorecard, src-fingerprint, melange, gptscript, trufflehog, flux-source-controller, dagger, trivy-operator, gitaly, argo-workflows, grafana-alloy, guac, kubevela, kyverno,...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: rancher-fleet, snyk-cli, flux, gitsign, argo-cd, crossplane, gomplate, teleport, kaniko, tfsec, scorecard, src-fingerprint, melange, gptscript, trufflehog, flux-source-controller, dagger, trivy-operator, gitaly, argo-workflows, grafana-alloy, guac, kubevela, kyverno,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: argo-rollouts, hey, apache-exporter, kubewatch, timestamp-authority, cert-manager-webhook-pdns, frp, tfsec, crossplane-provider-aws-route53, maru, cert-manager-csi-driver, restic, cadvisor, mailpit, nri-mongodb, crossplane-provider-aws-kms, mods, telegraf, kpt,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: argo-rollouts, hey, apache-exporter, kubewatch, timestamp-authority, cert-manager-webhook-pdns, frp, tfsec, crossplane-provider-aws-route53, maru, cert-manager-csi-driver, restic, cadvisor, kratos, mailpit, nri-mongodb, crossplane-provider-aws-kms, mods, telegraf, kp...

CVE-2025-27379

A stored cross-site scripting XSS vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content...

CVE-2025-27379

A stored cross-site scripting XSS vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content...

CVE-2025-27379 Stored Cross-Site Scripting in AES BOM Viewer

A stored cross-site scripting XSS vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content...

CVE-2025-27379

CVE-2025-27379 affects the BOM Viewer in Altium AES 7.0.3. A stored XSS vulnerability allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content. The issue is tied to the Description...

CVE-2025-27379 Stored Cross-Site Scripting in AES BOM Viewer

A stored cross-site scripting XSS vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content...

CVE-2025-27379

A stored cross-site scripting XSS vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content...

PT-2026-3895

A stored cross-site scripting XSS vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content...