CVE-2026-74875: Insufficient Verification of Data Authenticity

opensslencrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process...

CVE-2026-53960: Missing Authorization

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A QAPage JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engi...

PT-2026-73238

Apache Airflow's secrets masker did not mask var.json Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an isinstancestr guard — so a secret stored as a JSON Variable and referenced in a template via var.json was displayed in cleartext to any user with...

Unity Linux 20.1070e Security Update: log4j (UTSA-2026-099511)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099511 advisory. Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JS...

PT-2026-76611

openssl encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process...

PT-2026-76809

Name of the Vulnerable Software and Affected Versions SWE-agent's trajectory inspector version 1.1.0 Description The HTTP server fails to properly sanitize request paths in the '/trajectory/' endpoint, allowing the use of parent-directory '..' references to perform path traversal. The server bind...

Unity Linux 20.1070e Security Update: log4j (UTSA-2026-099531)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099531 advisory. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue...

Exploit for CVE-2026-73633

CVE-2026-73633 Apache Struts S2-072 — PoC + Environment...

EUVD-2026-59778

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the podsadmin AJAX router funnels every access check — including the method allowlist, nonce...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the endpoint that collects Content Security Policy violation reports. An attacker can cause excessive memory consumption and disrupt service availability by submitting a large,...

Unsynchronized Access to Shared Data in a Multithreaded Context

Overview Affected versions of this package are vulnerable to Unsynchronized Access to Shared Data in a Multithreaded Context in the JSON plugin due to shared parsing state across concurrent requests. An attacker can access data associated with another user's request or bypass configured parsing...

Unsynchronized Access to Shared Data in a Multithreaded Context

Overview Affected versions of this package are vulnerable to Unsynchronized Access to Shared Data in a Multithreaded Context in the JSON plugin's SMD/JSON-RPC handling. An attacker can access response content intended for another user's session by making concurrent requests, potentially exposing...

CVE-2026-73631

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intende...

CVE-2026-73632

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73632

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73631

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intende...

CVE-2026-73632 Apache Struts: Shared serialization state in the JSON plugin

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

EUVD-2026-59606

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73632

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73632

Apache Struts version 7.2.1 is vulnerable to a data exposure flaw in the JSON plugin due to unsynchronized access to shared data in a multithreaded context. Specifically, the per-response serialization state for SMD / JSON-RPC handling could be shared across concurrent requests, potentially allow...