CVE-2026-55891

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri in lib/Request.php passes $SERVER'REQUESTURI' through FILTERSANITIZEURL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::init stores t...

CVE-2026-55891 PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri in lib/Request.php passes $SERVER'REQUESTURI' through FILTERSANITIZEURL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::init stores t...

CVE-2026-77184 MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in...

vamp-forticheck

vamp-forticheck VampSecure Labs — Security Research Division Scanner di vulnerabilità critiche nei dispositivi FortiOS/FortiGate. Descrizione Strumento di audit di sicurezza per valutare l'esposizione dei dispositivi Fortinet rispetto a quattro vulnerabilità critiche pubblicamente documentate...

CVE-2026-37736

An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...

json-flattener:FlattenFuzzer: Security exception in com.github.wnameless.json.flattener.JsonFlattener.jsonVal2Obj

Project: https://github.com/wnameless/json-flattener.git Detailed Report: https://oss-fuzz.com/testcase?key=5587817015869440 Project: json-flattener Fuzzing Engine: libFuzzer Fuzz Target: FlattenFuzzer Job Type: libfuzzerasanjson-flattener Platform Id: linux Crash Type: Security exception Crash...

Security Bulletin: Security Vulnerability in Nimbus Jose JWT Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-53864)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability in Nimbus Jose JWT Vulnerability Details CVEID:CVE-2025-53864 DESCRIPTION: Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a...

CVE-2026-37736

The OWASP json-sanitizer version v1.2.3 is affected by a vulnerability in the JsonSanitizer.sanitize() component. An attacker can provide a crafted input to trigger a Denial of Service (DoS) . The vulnerability is characterized as an Allocation of Resources Without Limits or Throttling . No speci...

The vulnerability of the JSON data processing tool JQ, related to buffer overflows, allows attackers to trigger a denial-of-service attack.

The vulnerability of the JSON data processing tool JQ is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-37736: Allocation of Resources Without Limits or Throttling

An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-37736

An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-55891: Improper Encoding or Escaping of Output

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri in lib/Request.php passes $SERVER'REQUESTURI' through FILTERSANITIZEURL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::init stores t...

The vulnerability of the JSON data processing tool JQ, related to uncontrolled recursion, allows a hacker to cause a service failure.

The vulnerability of the JSON data processing tool JQ is related to uncontrolled recursion. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-83080

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to 30.1 Description Authentication is not enforced on the 'report4.json.php' and 'report4.1.json.php' endpoints. This allows unauthenticated users to send GET requests to these endpoints to retrieve daily and...

CVE-2026-37736

An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...

PT-2026-83351

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri in lib/Request.php passes $ SERVER'REQUEST URI' through FILTER SANITIZE URL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller:: init...

PT-2026-83126

An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...

EUVD-2026-67773

An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-37736

An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-77184: Improper Neutralization of Special Elements used in an SQL Command

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in...