CVE-2026-104183: Improperly Controlled Modification of Object Prototype Attributes

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...

PT-2026-105797

Impact For views that opt into state snapshots, the snapshot state json embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned state json in their page and return it in the reconnect mount frame to inject arbitrary vie...

CVE-2026-103292: Improper Neutralization of Input During Web Page Generation

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

PT-2026-103824

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghost head helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

PT-2026-103966

🚨Critical - Authlib OpenID Discovery Cache Poisoning CVE-2026-104056 Authlib caches OIDC discovery JSON .well-known/openid-configuration without validating issuer/origin binding. By poisoning the cached discovery response, an attacker can swap authorization/token/jwks uri endpoints to...

CVE-2026-104182: Inefficient Algorithmic Complexity

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...

Rocky Linux 9 [CIQ] Security Update: python3.11-PyMySQL / python3.11-PyMySQL+rsa (crlsa-2024_9194)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20249194 advisory. python-pymysql: SQL injection if used with untrusted JSON input CVE-2024-36039 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: python3.12-PyMySQL / python3.12-PyMySQL+rsa (crlsa-2024_9193)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20249193 advisory. python-pymysql: SQL injection if used with untrusted JSON input CVE-2024-36039 Tenable has extracted the preceding description block directly from the CIQ security...

AlmaLinux 9.6 [TuxCare] Security Update: iperf3 / iperf3-devel (ALMALINUX9.6:CLSA-2026:1788821988)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788821988 advisory. - A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control- channel JSON with oversized numeri...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-debuginfo / ruby-debugsource / ruby-devel / ruby-doc / etc Multiple Vulnerabilities (crlsa-2021_2587)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20212587 advisory. ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? CVE-2019-15845 ruby: Regular expression denial of service vulnerability of WEBrick's...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-debuginfo / ruby-debugsource / ruby-devel / ruby-doc / etc Multiple Vulnerabilities (crlsa-2021_2588)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20212588 advisory. rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code CVE-2019-3881 ruby: NUL injection vulnerability of...

Rocky Linux 9 [CIQ] Security Update: perl-JSON-XS / perl-JSON-XS-debuginfo / perl-JSON-XS-debugsource (crlsa-2025_17162)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202517162 advisory. JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON CVE-2025-40928 Tenable has extracted the preceding description block directly from th...

Rocky Linux 8 [CIQ] Security Update: python3.12-PyMySQL (crlsa-2024_4245)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20244245 advisory. python-pymysql: SQL injection if used with untrusted JSON input CVE-2024-36039 Tenable has extracted the preceding description block directly from the CIQ security...

AlmaLinux 9.2 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc (ALMALINUX9.2:CLSA-2026:1777477457)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777477457 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, a crafted image...

Rocky Linux 8 [CIQ] Security Update: perl-JSON-XS / perl-JSON-XS-debuginfo / perl-JSON-XS-debugsource (crlsa-2025_17163)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202517163 advisory. JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON CVE-2025-40928 Tenable has extracted the preceding description block directly from th...

AlmaLinux 9.2 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778297730)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778297730 advisory. - In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malforme...

AlmaLinux 9.2 [TuxCare] Security Update: iperf3 / iperf3-devel (ALMALINUX9.2:CLSA-2026:1788532080)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788532080 advisory. - A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control- channel JSON with oversized numeri...

CVE-2026-104056: Undefined Security Weakness

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CentOS Linux 7.9 [CIQ] Security Update: json-c / json-c-devel / json-c-doc (ciqsa-2026_1197)

The CentOS Linux 7.9 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261197 advisory. This advisory aggregates security fixes for the json-c SRPM in CIQ CentOS Bridge 7.9. It addresses 1 CVE: CVE-2020-12762. Tenable has extracted the preceding...

Rocky Linux 10.2 [CIQ] Security Update: iperf3 / iperf3-debuginfo / iperf3-debugsource (crlsa-2026_61680)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202661680 advisory. iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion CVE-2026-71217 Tenable has...