EUVD-2024-55741

A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data...

CVE-2024-7952 DataEdgePlatform DataMosaix™ Private Cloud

A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data...

Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

Vulnerability Details File: node.js Function: normalizeStats line 214, reached from getStat called unconditionally on every browserslist call and loadStat Root Cause js function normalizeStatsdata, stats if !data data = if stats && 'dataByBrowser' in stats stats = stats.dataByBrowser if typeof...

GHSA-73WF-GQ98-2V4G Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

Vulnerability Details File: node.js Function: normalizeStats line 214, reached from getStat called unconditionally on every browserslist call and loadStat Root Cause js function normalizeStatsdata, stats if !data data = if stats && 'dataByBrowser' in stats stats = stats.dataByBrowser if typeof...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

WordPress Divi plugin <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Dynamic Content Legacy JSON Format Shortcode vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Theme Divi versions = 4.27.6...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Security Bypass.

Summary golang-jwt/jwt is used by IBM Storage Fusion Data Foundation, which could cause Security Bypass. CVE-2024-51744, CVE-2025-30204. Vulnerability Details CVEID:CVE-2024-51744 DESCRIPTION: golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in...

RLSA-2026:61680 Important: iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fixes: iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via...

iperf3 security update

An update is available for iperf3. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Iperf is a tool which can measure maximum TCP bandwidth and tune various...

CVE-2026-84189

LibreNMS through 26.4.0 is affected by a stored XSS in the Oxidized integration . JSON fields (name , ip , model , author , commit message ) returned by the admin-configurable oxidized.url are rendered into the device showconfig page without htmlspecialchars(). An administrator who points the Oxi...

CVE-2026-84189 LibreNMS before 26.7.0 Stored XSS via Oxidized API

LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...

CVE-2026-83772

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function csetreportsdecode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is...

RLSA-2026:61389 Important: iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fixes: iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via...

iperf3 security update

An update is available for iperf3. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Iperf is a tool which can measure maximum TCP bandwidth and tune various...

CVE-2026-83772 Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injection

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function csetreportsdecode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is...

EUVD-2026-68984

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function csetreportsdecode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is...

CVE-2026-83772 Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injection

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function csetreportsdecode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is...

CVE-2026-83772

Cobham SATCOM VSAT7090 Maritime Satellite Router versions up to 20260704 are affected by a command injection vulnerability in the JSON Parsing component. The root cause lies in the function c_set_reports_decode within the file mail-report.sh , where unsanitized manipulation of the sender/recipien...

UBUNTU-CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

CVE-2026-83772: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function csetreportsdecode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is...