CLSA-2026-1778173472 exim: Fix of 2 CVEs

CVE-2026-40685: fix heap corruption when expanding malformed JSON - CVE-2026-40687: fix heap buffer overflow and infoleak in SPA authenticator...

RLSA-2026:13916 Important: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: pyjwt: PyJWT accepts unknown crit header extensions RFC 7515 ?4.1.11 MU...

OPENSUSE-SU-2026:20705-1 Security update for log4cxx

This update for log4cxx fixes the following issues: Changes in log4cxx: - update to 1.7.0 bsc1261994, CVE-2026-40023: Non-ascii characters incorrectly encoded in JSON output 615 XML output could contain characters not allowed by the XML 1.0 specification An XML configuration file with recursive...

CLSA-2026-1778147239 exim: Fix of CVE-2026-40685

CVE-2026-40685: fix OOB heap write in dewrap during JSON expansion...

CLSA-2026-1778143159 jq: Fix of 2 CVEs

CVE-2026-33948: fix NUL truncation in JSON parser validation bypass - CVE-2026-33947: fix unbounded recursion stack overflow in jvsetpath/getpath/delpaths...

CLSA-2026-1778142360 jq: Fix of 2 CVEs

CVE-2026-33947: limit path depth in jvsetpath, jvgetpath, and jvdelpaths to prevent stack overflow from deep path arrays - CVE-2026-33948: remove strlen-based length calculation that truncated JSON input at embedded NUL bytes, preventing parser-differential attacks...

K000161154: Sequelize vulnerability CVE-2026-30951

Security Advisory Description Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The traverseJSON function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST... AS SQL. An...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in JWT validation middleware. An attacker can maintain unauthorized access to user accounts by reusing previously issued JSON Web Tokens even after a password change, as the tokens are not invalidated or...

GHSA-258C-965C-P3HC Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change

Summary A session invalidation vulnerability exists in daptin's authentication system where JSON Web Tokens JWTs remain fully valid after a user changes their password. The JWT validation middleware CheckJWT only verifies token signature, expiry, issuer, and signing algorithm — it does not check...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in JWT validation middleware. An attacker can maintain unauthorized access to user accounts by reusing previously issued JSON Web Tokens even after a password change, as the tokens are not invalidated or...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in JWT validation middleware. An attacker can maintain unauthorized access to user accounts by reusing previously issued JSON Web Tokens even after a password change, as the tokens are not invalidated or...

Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change

Summary A session invalidation vulnerability exists in daptin's authentication system where JSON Web Tokens JWTs remain fully valid after a user changes their password. The JWT validation middleware CheckJWT only verifies token signature, expiry, issuer, and signing algorithm — it does not check...

GHSA-W239-58X2-Q8P5 go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth

The DAG-CBOR and DAG-JSON decoders recurse on each nested map or list without a depth limit. A payload containing deeply nested collections causes the decoder to recurse once per level, growing the goroutine stack until the Go runtime terminates the process with a fatal stack overflow distinct fr...

go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth

The DAG-CBOR and DAG-JSON decoders recurse on each nested map or list without a depth limit. A payload containing deeply nested collections causes the decoder to recurse once per level, growing the goroutine stack until the Go runtime terminates the process with a fatal stack overflow distinct fr...

com.microsoft.kiota:microsoft-kiota-authentication-azure (0.4.4), com.microsoft.kiota:microsoft-kiota-http-okhttp (0.4.4) +3 more potentially affected by CVE-2026-44503 via com.microsoft.kiota:microsoft-kiota-abstractions (0.4.4)

com.microsoft.kiota:microsoft-kiota-abstractions MAVEN version 0.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.kiota:microsoft-kiota-abstractions and may be impacted: - com.microsoft.kiota:microsoft-kiota-authentication-azure 0.4.4 ...

com.microsoft.kiota:microsoft-kiota-authentication-azure (0.4.3), com.microsoft.kiota:microsoft-kiota-http-okhttp (0.4.3) +3 more potentially affected by CVE-2026-44503 via com.microsoft.kiota:microsoft-kiota-abstractions (0.4.3)

com.microsoft.kiota:microsoft-kiota-abstractions MAVEN version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.kiota:microsoft-kiota-abstractions and may be impacted: - com.microsoft.kiota:microsoft-kiota-authentication-azure 0.4.3 ...

com.microsoft.kiota:microsoft-kiota-authentication-azure (0.7.0), com.microsoft.kiota:microsoft-kiota-http-okhttp (0.7.0) +4 more potentially affected by CVE-2026-44503 via com.microsoft.kiota:microsoft-kiota-abstractions (0.7.0)

com.microsoft.kiota:microsoft-kiota-abstractions MAVEN version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.kiota:microsoft-kiota-abstractions and may be impacted: - com.microsoft.kiota:microsoft-kiota-authentication-azure 0.7.0 ...

com.microsoft.kiota:microsoft-kiota-authentication-azure (0.5.0), com.microsoft.kiota:microsoft-kiota-http-okhttp (0.5.0) +4 more potentially affected by CVE-2026-44503 via com.microsoft.kiota:microsoft-kiota-abstractions (0.5.0)

com.microsoft.kiota:microsoft-kiota-abstractions MAVEN version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.microsoft.kiota:microsoft-kiota-abstractions and may be impacted: - com.microsoft.kiota:microsoft-kiota-authentication-azure 0.5.0 ...

JeecgBoot injection vulnerability

JeecgBoot is a Java low-code platform developed by Jeecg Corporation, designed for enterprise web applications. JeecgBoot versions 3.9.1 and earlier have a vulnerability related to injection attacks. This vulnerability stems from the parameter condition handled by the JSON object processor in the...

CVE-2026-8114: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in JeecgBoot up to 3.9.1. Affected by this issue is some unknown functionality of the file /sys/dict/loadTreeData of the component JSON Object Handler. The manipulation of the argument condition leads to sql injection. The attack can be initiated remotely. The explo...