Swagger-HTML-Injection-CVE-2025-8191

https://example.com/swagger/swagger.html?configURL=https://raw.githubusercontent.com/mayank-s16/Swagger-HTML-Injection-CVE-2025-8191/refs/heads/main/test.json...

PT-2026-104591

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

json-sanitizer

json-sanitizer Dado contenido similar a JSON, el JSON Sanitizer lo convierte en JSON válido. Primeros pasos - Contacto Se puede conectar en cualquiera de los extremos de una canalización de datos para ayudar a satisfacer el principio de Postel: sé conservador en lo que haces, sé liberal en lo que...

rhuss__jolokia_CVE-2018-1000129_1-4-0

Jolokia es una forma novedosa de acceder remotamente a los MBeans JMX. Es diferente de los conectores JSR-160 en que es un enfoque basado en agentes que utiliza JSON sobre HTTP para su comunicación, de un modo al estilo REST. Se proporcionan múltiples agentes para diferentes entornos: Agente WAR...

acmer (>=0.0.1, <=0.0.4), auth-proxy (>=0.0.1, <=0.1.1) +458 more potentially affected by CVE-2026-18140 via aws-smithy-json (>=0.27.0-alpha.1, <=0.56.1)

aws-smithy-json CARGO version =0.27.0-alpha.1, =0.0.1, =0.0.1, =0.0.1, =0.0.22-alpha, =0.0.1, =0.0.1, =0.1.0, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.34.0 and more Source cves: CVE-2026-18140 Source advisory: OSV:GHSA-8FFR-XGWF-X...

GHSA-8FFR-XGWF-XJ56 aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists which allows uncontrolled recursion in the unknown-key skip path of the...

EUVD-2026-51271

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers...

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists which allows uncontrolled recursion in the unknown-key skip path of the...

raccoon_config

raccoonconfig Scans a list of raccoon servers from Tria.ge and extracts the config as JSON. If you like, it can also automatically send follow-up malware extracted from the Raccoon config to Tria.ge API key required Resources: Logo: https://www.deviantart.com/snatti89/art/193-365-Mugshot-58870035...

CollaRE

CollaRE v1.4 Introduction CollaRE is a tool for collaborative reverse engineering that aims to allow teams that do need to use more then one tool during a project to collaborate without the need to share the files on a separate location. It also contains a very simple user management and as such...

spring-break_cve-2017-8046

spring-breakcve-2017-8046 Este es un programa Java que explota la vulnerabilidad Spring Break CVE-2017-8046. Este software está escrito para tener la menor cantidad de dependencias externas posible. AVISO LEGAL Esta herramienta está destinada a ingenieros de seguridad y profesionales de appsec pa...

CVE-2026-103036

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

EUVD-2026-91791

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

CVE-2026-103036

The oRPC tool (specifically the @orpc/json-schema SmartCoercionPlugin ) is vulnerable to a prototype injection issue in versions prior to 1.14.9 . The root cause is the use of JsonSchemaCoercer to resolve schema.properties entries through the prototype chain. A remote client can supply __proto__ ...

CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

CVE-2026-104845

A flaw was found in seroval. A remote attacker can cause a Denial of Service DoS by providing crafted JSON input containing an excessively large array length during data deserialization. Due to missing bounds validation when reconstructing array structures, the application synchronously allocates...

CVE-2026-104906

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

CVE-2026-104845 Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does not bound the serialized element count. An attacker can...