CVE-2026-25790 Wazuh has Stack-Based Buffer Overflow in Security Configuration Assessment JSON Parser

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, multiple stack-based buffer overflows exist in the Security Configuration Assessment SCA decoder wazuh-analysisd. The use of sprintf with a...

EUVD-2026-12623

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, multiple stack-based buffer overflows exist in the Security Configuration Assessment SCA decoder wazuh-analysisd. The use of sprintf with a...

CVE-2026-25790 Wazuh has Stack-Based Buffer Overflow in Security Configuration Assessment JSON Parser

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, multiple stack-based buffer overflows exist in the Security Configuration Assessment SCA decoder wazuh-analysisd. The use of sprintf with a...

CVE-2026-25790

Wazuh CVE-2026-25790 affects the Security Configuration Assessment (SCA) decoder in wazuh-analysisd, with stack-based buffer overflows from using sprintf(value, "%lf", …) into a fixed 128-byte buffer. The vulnerability exists in multiple locations within /src/analysisd/decoders/security_configura...

GHSA-43W5-MMXV-CPVH Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices

In JsonBeanPropertyBinder::expandArrayToThreshold in io.micronaut:micronaut-json-core before Micronaut 4 4.10.16 and in Micronaut 3 before 3.10.5 does not correctly handle descending array index order during form-urlencoded body binding, which allows remote attackers to cause a denial of service...

com.agorapulse:gru-micronaut (1.4.0), com.agorapulse:micronaut-amazon-awssdk-cloudwatch (>=1.6.1-micronaut-3.0, <=2.2.2-micronaut-3.0) +508 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=3.1.0, <=3.10.4)

io.micronaut:micronaut-json-core MAVEN version =3.1.0, =1.6.1-micronaut-3.0, =2.0.8-micronaut-3.0, =1.6.1-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.2-micronaut-3.0, =2.0.0-micronaut-3.0, =1.7.2-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.1-micronaut-3.0,...

com.agorapulse:micronaut-amazon-awssdk-dynamodb-loader (>=3.4.3, <=4.2.0), com.agorapulse:micronaut-amazon-awssdk-kinesis (>=3.4.3, <=4.2.0) +476 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=4.0.0-m1, <=4.10.15)

io.micronaut:micronaut-json-core MAVEN version =4.0.0-m1, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.5.1 and more Source cves: CVE-2026-33013 Source advisory: OSV:GHSA-43W5-MMXV-CPVH...

com.agorapulse:micronaut-amazon-awssdk-dynamodb-loader (>=3.4.3, <=4.2.0), com.agorapulse:micronaut-amazon-awssdk-kinesis (>=3.4.3, <=4.2.0) +476 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=4.0.0-m1, <=4.10.15)

io.micronaut:micronaut-json-core MAVEN version =4.0.0-m1, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.5.1 and more Source cves: CVE-2026-33013 Source advisory: GHSA-43W5-MMXV-CPVH...

com.agorapulse:micronaut-amazon-awssdk-cloudwatch (>=1.6.1-micronaut-3.0, <=2.2.2-micronaut-3.0), com.agorapulse:micronaut-amazon-awssdk-cloudwatchlogs (>=2.0.8-micronaut-3.0, <=2.2.2-micronaut-3.0) +448 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=3.1.0, <=3.8.12)

io.micronaut:micronaut-json-core MAVEN version =3.1.0, =1.6.1-micronaut-3.0, =2.0.8-micronaut-3.0, =1.6.1-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.2-micronaut-3.0, =2.0.0-micronaut-3.0, =1.7.2-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.1-micronaut-3.0,...

com.agorapulse:gru-micronaut (1.4.0), com.bertramlabs.plugins:asset-pipeline-grails (>=4.5.0, <=4.5.2) +184 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=3.9.0, <=3.10.4)

io.micronaut:micronaut-json-core MAVEN version =3.9.0, =4.5.0, =1.3.6, =1.30.0, =2.14.0, =2.12.0, =1.13.0, =0.1.0, =6.0.9, =6.0.10 - io.github.matrei:grails-inertia-plugin 2.0.0 and more Source cves: CVE-2026-33013 Source advisory: GHSA-43W5-MMXV-CPVH...

com.agorapulse:micronaut-amazon-awssdk-dynamodb-loader (>=3.4.3, <=4.2.0), com.agorapulse:micronaut-amazon-awssdk-kinesis (>=3.4.3, <=4.2.0) +476 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=4.0.0-m1, <=4.10.15)

io.micronaut:micronaut-json-core MAVEN version =4.0.0-m1, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.5.1 and more Source cves: CVE-2026-33013 Source advisory: SNYK:JAVA-IOMICRONAUT-15682607...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the JsonBeanPropertyBinder::expandArrayToThreshold function of the form-urlencoded body binding process. An attacker can cause sustained CPU usage and unbounded memory growth,...

com.agorapulse:gru-micronaut (1.4.0), com.bertramlabs.plugins:asset-pipeline-grails (>=4.5.0, <=4.5.2) +184 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=3.9.0, <=3.10.4)

io.micronaut:micronaut-json-core MAVEN version =3.9.0, =4.5.0, =1.3.6, =1.30.0, =2.14.0, =2.12.0, =1.13.0, =0.1.0, =6.0.9, =6.0.10 - io.github.matrei:grails-inertia-plugin 2.0.0 and more Source cves: CVE-2026-33013 Source advisory: OSV:GHSA-43W5-MMXV-CPVH...

com.agorapulse:micronaut-amazon-awssdk-cloudwatch (>=1.6.1-micronaut-3.0, <=2.2.2-micronaut-3.0), com.agorapulse:micronaut-amazon-awssdk-cloudwatchlogs (>=2.0.8-micronaut-3.0, <=2.2.2-micronaut-3.0) +448 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=3.1.0, <=3.8.12)

io.micronaut:micronaut-json-core MAVEN version =3.1.0, =1.6.1-micronaut-3.0, =2.0.8-micronaut-3.0, =1.6.1-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.2-micronaut-3.0, =2.0.0-micronaut-3.0, =1.7.2-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.1-micronaut-3.0,...

io.micronaut.aws:micronaut-aws-alexa (5.0.0-m1), io.micronaut.aws:micronaut-aws-alexa-httpserver (5.0.0-m1) +137 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=5.0.0-m1, <=5.0.0-m13)

io.micronaut:micronaut-json-core MAVEN version =5.0.0-m1, =5.0.0-m13 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-json-core and may be impacted: - io.micronaut.aws:micronaut-aws-alexa 5.0.0-m1 -...

SUSE CVE-2026-27962

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any...

SUSE CVE-2026-28490

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption JWE RSA15 key management algorithm. Authlib registe...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the MariaDBFilterExpressionConverter, which allows attackers to bypass metadata-based access controls and execute SQL statements with malicious JSONVALUE input. Remediation Upgrade...

EulerOS 2.0 SP11 : haproxy (EulerOS-SA-2026-1580)

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON...

Improper Verification of Cryptographic Signature

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the JsonWebSignature.preparealgorithmkey method in authlib/jose/rfc7515/jws.py. An attacker can bypass authenticatio...