752 matches found
CVE-2026-0915-json-Patch.-V2.0
CVE-2026-0915-json-Patch.-V2.0 Patch the Bug - glibc š JSON Validator Security Patch Enterprise-grade solution for CVE-2026-0915 - Protects against insecure JSON parsing through strict schema validation. šØ Security Notice This patch fixes CVE-2026-0915 - a critical vulnerability in JSON parsing...
Detection-and-Mitigation-script-for-CVE-2021-42717
Detection-and-Mitigation-script-for-CVE-2021-42717 Detection and Mitigation script for CVE-2021-42717 - ModSecurity DoS Vulnerability in JSON Parsing ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in...
json_cve_2020_10663
Workaround for CVE-2020-10663 vulnerability in json gem The json gem has a security vulnerability CVE-2020-10663. When parsing certain JSON documents, the json gem can be coerced into creating arbitrary objects in the target system. Users are strongly advised to upgrade to json 2.3.0 or later. Fo...
Apache-couchdb-CVE-2017-12635
CouchDB Vertical Privilege Escalation Vulnerability CVE-2017-12635 Apache CouchDB is an open-source database that focuses on ease of use and being a "fully web-embracing database." It is a NoSQL database that uses JSON as the storage format, JavaScript as the query language, and MapReduce and HTT...
CVE-2026-54350-Budibase-NoSQL-Injection
CVE-2026-54350 ā Budibase Unauthenticated NoSQL Operator Injection Unauthenticated JSON/NoSQL operator injection in Budibase. Any anonymous visitor of a published Budibase app that exposes a PUBLIC query backed by a document datasource MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST wi...
crack-0.1.8-fixed
= crack Really simple JSON and XML parsing, ripped from Merb and Rails. The XML parser is ripped from Merb and the JSON parser is ripped from Rails. I take no credit, just packaged them for all to enjoy and easily use. == note on releases Releases are tagged on github and also released as gems on...
couchdb-exploit
š CouchDB Exploit - CVE-2017-12635 & CVE-2017-12636 Apache CouchDB - Privilege Escalation & Remote Code Execution š Overview This tool exploits two critical vulnerabilities in Apache CouchDB: CVE| Description| Severity ---|---|--- CVE-2017-12635| Privilege Escalation via JSON Parsing Bypass| š“...
CVE-2022-33171
CVE-2022-33171: TypeORM SQL Injection Note: This is a work-in-progress analysis of CVE-2022-33171. The details provided here may be updated as further information becomes available.currently not working Vulnerability Details CVE ID: CVE-2022-33171 Product: TypeORM Affected Versions: 0.3.0...
CVE-2026-107717 Banks: User-controlled prompt input can be parsed as privileged chat messages
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chatmessages attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provide...
CVE-2026-106438
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application,...
CVE-2026-106438
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application,...
CVE-2026-106438: Incorrect Calculation
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application,...
CVE-2026-104183
A flaw was found in stream-json. When parsing JSON data, the Assembler component directly assigns properties, allowing an input key named 'proto' to replace a parsed object's internal prototype rather than creating a standard property. An attacker who supplies crafted input can exploit this...
CVE-2026-101101
A flaw was found in ag-ui. A remote authenticated attacker can trigger an uncaught exception during JSON parsing by submitting malformed input to the middleware component. This failure can cause the application to crash unexpectedly, resulting in a Denial of Service DoS. Mitigation Restrict netwo...
PT-2026-104011
Name of the Vulnerable Software and Affected Versions stream-json versions prior to 3.6.0 Description The Assembler component materializes object properties using plain assignment. When an input key is named proto , it invokes the inherited setter, leading to the replacement of the parsed object...
Exposure Of Data Element To Wrong Session
org.apache.struts, struts2-json-plugin is vulnerable to an exposure of data element to wrong session. The vulnerability is due to per-request JSON parsing state being shared across concurrent requests, which allows an attacker to potentially observe data associated with another request and bypass...
Fedora 43 : mongo-c-driver (2026-f74926c622)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f74926c622 advisory. libmongoc 1.30.9 Fixes - Fix OCSP error handling. CVE-2026-84964 - Fix unsafe casts during JSON parsing. CVE-2026-84965 - Fix possible unsafe...
Jawn: Quadratic parsing effort in AsyncParser
AsyncParser can be forced to perform On^2 work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start. Impact Denial of service via CPU exhaustion when parsing untrusted JSON. Preconditions: - Application...
GHSA-W4CM-GVHJ-CGW6 Jawn: Quadratic parsing effort in AsyncParser
AsyncParser can be forced to perform On^2 work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start. Impact Denial of service via CPU exhaustion when parsing untrusted JSON. Preconditions: - Application...
SUSE CVE-2026-61551
Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port...