AlmaLinux 9.6 [TuxCare] Security Update: log4j / log4j-jcl / log4j-slf4j / log4j-web (ALMALINUX9.6:CLSA-2026:1784624635)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784624635 advisory. - Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not...

AlmaLinux 9.2 [TuxCare] Security Update: libfastjson / libfastjson-devel (ALMALINUX9.2:CLSA-2025:1751892313)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751892313 advisory. - json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbufmemappend...

Rocky Linux 10.0 [CIQ] Security Update: perl-JSON-XS / perl-JSON-XS-debuginfo / perl-JSON-XS-debugsource (crlsa-2025_17119)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202517119 advisory. JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON CVE-2025-40928 Tenable has extracted the preceding description block directly from...

Rocky Linux 9 [CIQ] Security Update: python3.12-PyMySQL / python3.12-PyMySQL+rsa (crlsa-2024_9193)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20249193 advisory. python-pymysql: SQL injection if used with untrusted JSON input CVE-2024-36039 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: python3.11-PyMySQL / python3.11-PyMySQL+rsa (crlsa-2024_9194)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20249194 advisory. python-pymysql: SQL injection if used with untrusted JSON input CVE-2024-36039 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: python3.12-PyMySQL (crlsa-2024_4245)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20244245 advisory. python-pymysql: SQL injection if used with untrusted JSON input CVE-2024-36039 Tenable has extracted the preceding description block directly from the CIQ security...

EUVD-2026-70989

fastify vulnerable to request validation bypass via skipped boolean false schemas...

fastify vulnerable to request validation bypass via skipped boolean false schemas

Impact Fastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance, but because false is falsy, a route that set body, querystring, params, or headers to false had...

EUVD-2026-70998

fastify vulnerable to header validation bypass via incomplete schema case normalization...

GHSA-9Q9J-Q6P8-XQ58 fastify vulnerable to header validation bypass via incomplete schema case normalization

Impact Fastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level properties keys and the root required array, and did not lowercase the JSON Schema Draft 7...

[SECURITY] [DLA-4803-1] ruby-oj security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4803-1 [email protected] https://www.debian.org/lts/security/ Simon Quigley September 30, 2026 https://wiki.debian.org/LTS -...

Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to Improper Encoding due to Apache Log4j (CVE-2026-49844)

Summary Apache Log4j is shipped with IBM Tivoli Netcool Impact as part of its logging infrasture. Information about a security vulnerability affecting Apache Log4j has been published in a security bulletin. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite...

Security Bulletin: IBM Maximo Application Suite uses log4j-api-2.25.4.jar which is vulnerable to CVE-2026-49844

Summary IBM Maximo Application Suite uses log4j-api-2.25.4.jar which is vulnerable to CVE-2026-49844. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values durin...

Malicious Package

Overview json-bigint-rs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @hrmony/hyper-json-builder is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

GHSA-9F6G-J8CH-79G4 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard-fips, http-https-echo-fips, wazuh-dashboard, http-https-echo, json-server, azurite, tileserver-gl...

CVE-2026-87859 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard-fips, http-https-echo-fips, wazuh-dashboard, http-https-echo, json-server, azurite, tileserver-gl...

CVE-2026-87859 vulnerabilities

Vulnerabilities for packages: json-server, tileserver-gl...

GHSA-9F6G-J8CH-79G4 vulnerabilities

Vulnerabilities for packages: json-server, tileserver-gl...

Malicious code in json-bigint-rs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f5b71b917a0504deb87a597d9d07527179c2d6bb9ec1f836caa34d6145aa043 On require, index.js instantiates the shipped json-bigint-rs.wasm module and, for imports declared under the 'wasm:js/string-constants' module...