Lucene search
+L

53750 matches found

OSV
OSV
added 2026/07/28 9:30 p.m.5 views

GHSA-RFR2-MQ9M-X2QX datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

Summary datamodel-code-generator's built-in HTTP fetcher http.getbody issues an httpx.GET against any URL passed to --url or reached via a redirect chain with no allow-list, no deny-list, no IP/host validation, and followredirects=True. Loopback addresses, RFC1918 ranges, link-local 169.254.169.2...

8.2CVSS6AI score0.00209EPSS
SaveExploits0References4
SUSE CVE
SUSE CVE
added 2026/07/28 5:20 p.m.8 views

SUSE CVE-2026-17501

A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull...

6.9CVSS5.5AI score0.00419EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/28 4:19 p.m.10 views

CVE-2026-54593

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...

8.1CVSS0.00357EPSS
SaveExploits0References4
NVD
NVD
added 2026/07/28 4:18 p.m.15 views

CVE-2026-51263

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

0.00434EPSS
SaveExploits0
RedhatCVE
RedhatCVE
added 2026/07/28 4:7 p.m.5 views

CVE-2026-51296

A flaw was found in SQLite. A use-after-free vulnerability in the SQLite JSON module's jsonRemoveFunc allows a remote attacker to cause a denial of service by crashing the service. This vulnerability can also lead to the disclosure of sensitive heap memory information...

7.2AI score0.00332EPSS
SaveExploits0References6
RedhatCVE
RedhatCVE
added 2026/07/28 4:7 p.m.4 views

CVE-2026-51297

A flaw was found in sqlite. This use-after-free vulnerability in the JSON parsing logic allows remote attackers to craft malicious JSON payloads. This can trigger memory deallocation followed by illegal memory access, potentially leading to arbitrary code execution, sensitive information leakage,...

7.9AI score0.00344EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/28 3:43 p.m.7 views

GHSA-8R6W-3QQ5-4P4R Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

Summary A privilege escalation vulnerability exists in the Wings /upload/file endpoint due to insufficient validation of panel-signed JWTs. Wings accepts any valid panel-signed JWT containing serveruuid, useruuid, and uniqueid, regardless of the token’s intended purpose. Because the Panel issues...

8.1CVSS6AI score0.00357EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment
added 2026/07/28 3:42 p.m.7 views

CVE-2026-54593 Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...

8.1CVSS6AI score0.00357EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/07/28 3:42 p.m.7 views

CVE-2026-54593

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...

8.1CVSS6AI score0.00357EPSS
SaveExploits0References5Affected Software1
EUVD
EUVD
added 2026/07/28 3:42 p.m.7 views

EUVD-2026-49880

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...

8.1CVSS6AI score0.00357EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/07/28 2:23 p.m.4 views

CVE-2026-54696

A flaw was found in Ruby JSON. A remote attacker could exploit a heap buffer overflow vulnerability by providing an oversized streamed object containing a specially crafted string. This could lead to a reliable process crash, resulting in a denial of service DoS for the affected system...

3.7CVSS6.1AI score0.00301EPSS
SaveExploits0References5
NVD
NVD
added 2026/07/28 1:19 p.m.11 views

CVE-2026-66920

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing a...

8.2CVSS0.00253EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/28 12:57 p.m.10 views

CVE-2026-66920

Pivotick is affected by an uncontrolled-recursion vulnerability in its graph processing and JSON viewer components. The issue arises when processing caller-supplied graph and node data, where recursive traversals over edges and node structures can exhaust the JavaScript call stack on specially cr...

8.2CVSS5.9AI score0.00253EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/28 12:57 p.m.36 views

CVE-2026-66920 Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing a...

8.2CVSS0.00253EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/28 12:57 p.m.9 views

EUVD-2026-49796

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing a...

8.2CVSS5.9AI score0.00253EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/28 12:57 p.m.6 views

CVE-2026-66920 Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing a...

8.2CVSS5.9AI score
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/07/28 10:25 a.m.5 views

CVE-2026-59888

A flaw was found in jackson-databind. When Java Records use a PropertyNamingStrategy, an attacker can bypass the @JsonIgnore annotation during deserialization. This allows a renamed JSON key to be assigned to a Record constructor parameter, even if it was intended to be ignored. Consequently, an...

6.5CVSS5.8AI score0.00247EPSS
SaveExploits0References7
RedhatCVE
RedhatCVE
added 2026/07/28 9:42 a.m.5 views

CVE-2026-57212

A flaw was found in RabbitMQ, a messaging and streaming broker. A remote attacker could exploit this vulnerability by sending oversized JSON bodies to the rabbitmqmanagement HTTP API. The API's body size check is incomplete, allowing the final combined size to exceed limits. This could lead to a...

7.7CVSS5.8AI score0.00433EPSS
SaveExploits1References9
RedhatCVE
RedhatCVE
added 2026/07/28 8:38 a.m.4 views

CVE-2026-51298

A flaw was found in SQLite. A remote attacker could exploit a use-after-free vulnerability in the JSON extraction function. This occurs when the program attempts to access memory after it has been freed, specifically within the JsonParse object. Successful exploitation of this vulnerability can...

7.5CVSS5.7AI score0.00112EPSS
SaveExploits0References5
OSV
OSV
added 2026/07/28 8:16 a.m.5 views

MAL-2026-11119 Malicious code in json-to-table-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2317bf7f973ca611fdd2215509ae94c302f868ae9fb5c5f00de0b6bd13fe3bc4 postinstall.js runs automatically on npm install and executes a shell pipeline via childprocess.exec that collects hostname, user, working directory,...

5.6AI score
SaveExploits0References1
Rows per page
Query Builder