CVE-2026-104182 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...

CVE-2026-104182 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...

CVE-2026-104182

The stream-json micro-library is vulnerable to a Denial of Service (DoS) via a flaw in its JSONC parser (specifically at stream-json/jsonc/parser.js and stream-json/jsonc/verifier.js). Prior to version 3.6.0 , the parser restarts comment-terminator scanning from the opening slash whenever a block...

Project-CVE-2026-33017

CVE-2026-33017 Langflow 스크립트 — 코드 설명 coded by: Xer0TLabs x Persephrak Decentralized Syndicate 이 문서의 목적 이 문서는 검토, 사고 대응 및 방어적 분석을 위해 제공된 Python 프로그램에 대한 높은 수준의 설명입니다. 이 문서는 의도적으로 운영 지침, 대상 선택 가이드, 페이로드 예시 또는 시스템 접근 권한 획득 절차를 포함하지 않습니다. 이 스크립트는 주장된 Langflow 인증 없는 원격 코드 실행 취약점에 대한 익스플로잇으로 자체 표시됩니다. ...

DEBIAN-CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

UBUNTU-CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-89274-wp-recipe-maker-poc

CVE-2026-89274 - Лаборатория валидации выполнения произвольных шорткодов в WP Recipe Maker Материалы для security-исследования по воспроизведению и валидации CVE-2026-89274 : WP Recipe Maker Используйте только на системах, которыми вы владеете или на которые у вас есть явное разрешение на...

Exploit for Excessive Platform Resource Consumption within a Loop in Trustwave Modsecurity

THIS IS A POC FOR LAST YEAR CVE INVOLVING modsecurity & libapa...

CVE-2024-6624

CVE-2024-6624 | JSON API User = 3.9.3 - Unauthenticated Privilege Escalation This is a Python script that exploits the CVE-2024-6624 vulnerability in the JSON API User = 3.9.3 plugin for WordPress. This tool allows unauthenticated attackers to register new users and escalate their privileges to...

EUVD-2026-91003

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056 CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056 CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056

The Authlib library (version 1.7.2 and below) contains a vulnerability where OpenID Connect (OIDC) and OAuth discovery metadata is cached without sufficient validation or issuer-origin binding . A remote attacker providing a malicious discovery response can replace legitimate service endpoints wi...

CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-101101

A flaw was found in ag-ui. A remote authenticated attacker can trigger an uncaught exception during JSON parsing by submitting malformed input to the middleware component. This failure can cause the application to crash unexpectedly, resulting in a Denial of Service DoS. Mitigation Restrict netwo...

CVE-2026-34308

CVE-2026-34308: MySQL Server JSON component denial of service Official vendor bulletin: Oracle Critical Patch Update Advisory — April 2026. Summary from published CVE Vulnerability in Oracle MySQL Server component: Server: JSON. Supported affected versions: 8.0.0–8.0.45 , 8.4.0–8.4.8 , and...

PYSEC-2026-4142 PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

Package pyjwt PyPI Affected versions tested & verified on: 2.13.0. Every version whose PyJWS.load translates only ValueError is affected Description PyJWS.looad jwt/apijws.py:337 splits the compact token, base64url decodes the header segment and hands it to json.loads before verifysignature runs...

MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

SummaryWhen OAuth tokens are saved, MCP Atlassian always writes a plaintext fallback copy under /.mcp-atlassian/oauth-.json. The fallback file is created with the process default umask rather than restrictive permissions. In this environment the file was created as mode 0664, exposing access and...