CVE-2026-54150

next-video is a library for adding video to Next.js applications. Prior to 2.8.1, the GET endpoint exported by next-video/request-handler and commonly mounted at /api/video accepts an unauthenticated url query parameter, while src/utils/utils.ts isRemote treats any value without an HTTP or HTTPS...

CVE-2026-86318

A flaw was found in java-json-tools json-patch. A remote attacker could exploit a stack-based buffer overflow vulnerability in the JsonMergePatch.fromJson function by sending specially crafted JSON input. This could lead to a denial of service, making the affected system unavailable. Mitigation...

CVE-2026-54150 next-video: Unauthenticated arbitrary file read via /api/video request handler

next-video is a library for adding video to Next.js applications. Prior to 2.8.1, the GET endpoint exported by next-video/request-handler and commonly mounted at /api/video accepts an unauthenticated url query parameter, while src/utils/utils.ts isRemote treats any value without an HTTP or HTTPS...

CVE-2026-54150

next-video (Mux's Next.js video library) versions prior to 2.8.1 contain an unauthenticated path traversal in the GET handler exported from next-video/request-handler (commonly mounted at /api/video). The url query parameter is checked only for an https?:// prefix; any other value is treated as a...

OESA-2026-3720 python-ujson security update

UltraJSON Security Fixes: UltraJSON aka ujson through 5.1.0 has a stack-based buffer overflow in BufferAppendIndentUnchecked called from encode. Exploitation can, for example, use a large amount of indentation.CVE-2021-45958 UltraJSON is a fast JSON encoder and decoder written in pure C with...

CVE-2026-61534 Yayson: Prototype pollution in the Store/LegacyStore deserialization

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type i...

CVE-2026-90715

A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravityjson.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been disclos...

CVE-2026-90714

A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravityjson.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been mad...

Astra Linux – Vulnerability in json-smart

A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4, which causes a denial of service DOS through a crafted web request...

Astra Linux – Vulnerability in json-smart

Json-smart is a performance-oriented JSON processor library. When encountering a ‘’ or ‘’ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limitations regarding the nesting of such arrays or objects. Since the parsi...

Astra Linux – Vulnerability in yajl

In the yajl-ruby gem version 1.3.0 for Ruby, when a properly crafted JSON file is provided to Yajl::Parser.new.parse, the entire Ruby process crashes with a SIGABRT in the yajlstringdecode function in yajlencode.c. This causes the entire Ruby process to terminate, potentially leading to a denial ...

Astra Linux – Vulnerability in Thrift

In Apache Thrift versions 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when receiving invalid input data...

Astra Linux – Vulnerability in node-json5

JSON5 is an extension to the popular JSON file format, designed to make it easier to write and maintain manually, especially for configuration files. The parse method in the JSON5 library, as of versions 1.0.1 and 2.2.1, does not restrict the parsing of keys named proto. This allows specially...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The values and valueslist methods on models with a JSONField are vulnerable to SQL injection when column aliases are used, due to a crafted JSON object key being passed as an argument...

Astra Linux – Vulnerability in node-ajv

The ajv Another JSON Schema Validator before version 8.18.0 is vulnerable to Regular Expression Denial of Service ReDoS when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax $data reference, which is passed directly to the JavaScript RegExp constructor...

Astra Linux – Vulnerability in cjson

In cJSON before version 1.7.18, parsestring has a heap-based buffer over-read issue, occurring through "1":1, without any trailing newline characters when cJSONParseWithLength is called...

Astra Linux – Vulnerability in libjson-xs-perl

JSON::XS before version 4.04 for Perl has an integer buffer overflow that causes a segfault when parsing crafted JSON, allowing for denial-of-service attacks or other unspecified impacts...

Astra Linux – Vulnerability in libcpanel-json-xs-perl

Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow that causes a segfault when parsing crafted JSON, allowing for denial-of-service attacks or other unspecified impacts...

Astra Linux – Vulnerability in ModSecurity-Apache

ModSecurity is an open-source, cross-platform Web application firewall WAF engine for Apache, IIS, and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in a specific scenario: when the payload’s content type is application/json, and there is at least one rule that...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, a crafted image could result in an out-of-bounds heap write when writing a YAML or JSON output, leading to a crash. This issue has been fixed in version 7.1.2-19...