71 matches found
CLEANSTART-2026-XO33958 jackson-databind binds a JSON string to a javax
CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...
CLEANSTART-2026-FS10758 jackson-databind binds a JSON string to a javax
Security vulnerability affects the sonarqube package. jackson-databind binds a JSON string to a javax...
CLEANSTART-2026-OM88391 jackson-databind binds a JSON string to a javax
Security vulnerability affects the sonarqube package. jackson-databind binds a JSON string to a javax...
CVE-2026-54238 Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization
Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed wit...
CLEANSTART-2026-VZ03493 jackson-databind binds a JSON string to a javax
CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...
CLEANSTART-2026-MA98261 jackson-databind binds a JSON string to a javax
Security vulnerability affects the keycloak package. jackson-databind binds a JSON string to a javax...
PT-2026-132972
Security vulnerability affects the keycloak package. jackson-databind binds a JSON string to a javax...
CVE-2026-112774: Improper Control of Generation of Code
Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout. Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys th...
CLEANSTART-2026-AW63553 jackson-databind binds a JSON string to a javax
Security vulnerability affects the solr package. jackson-databind binds a JSON string to a javax...
PT-2026-122263
Security vulnerability affects the solr package. jackson-databind binds a JSON string to a javax...
CLEANSTART-2026-QQ14312 jackson-databind binds a JSON string to a javax
CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...
CLEANSTART-2026-RK86392 jackson-databind binds a JSON string to a javax
CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...
CLEANSTART-2026-BM99045 jackson-databind binds a JSON string to a javax
CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...
CVE-2026-86098 ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape
ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpijsonstringescape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reac...
PT-2026-91808
ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi json string escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that...
CVE-2026-73071: Use After Free
Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, jsondecodeitem in src/json.c can retain a stale pointer after jsondecodestring invokes channelfill to refill and free the current buffer, causing the error path to read freed memory instead of reader-jsbuf +...
PT-2026-60657
Summary The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through serde asas =...
CVE-2026-50589
In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash...
AlmaLinux 9 : ruby:4.0 (ALSA-2026:20596)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:20596 advisory. ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection CVE-2026-33210 erb: ERB: Arbitrary code execution via...
