CVE-2026-27589 Caddy vulnerable to cross-origin config application via local admin API /load (caddy)

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API default listen 127.0.0.1:2019 exposes a state-changing POST /load endpoint that replaces the entire running configuration. When origin enforcement is not enabled enforceorigin not...

Secure-auth-api

🔐 Secure Auth API — Built → Broken → Fixed A hands-on securit...

SUSE-SU-2026:0618-1 Security update for protobuf

This update for protobuf fixes the following issues:i - CVE-2026-0994: Fixed google.protobuf.Any recursion depth bypass in Python jsonformat.ParseDict bsc1257173...

Malware in json-mapping-srcs

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in json-mapping-srcs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1a4791659c68903f36ecfbf9da2e8af6dacdb98a4a525d5f104d43b07260cca The package json-mapping-srcs was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1017 Malicious code in json-mapping-srcs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1a4791659c68903f36ecfbf9da2e8af6dacdb98a4a525d5f104d43b07260cca The package json-mapping-srcs was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview json-mapping-srcs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2026-7398

Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameteriz...

📄 Advanced JUNG Smart Visu Security Scanner

This is a multi-threaded security scanner for JUNG Smart Visu servers that detects reflected cross site scripting, header injection, open redirects, and JSON injection. It tests predefined endpoints with custom payloads, analyzes HTTP responses for vulnerabilities, and generates a detailed report...

python: protobuf: Protobuf: Denial of Service due to recursion depth bypass

A flaw was found in protobuf. A remote attacker can exploit this denial-of-service DoS vulnerability by supplying deeply nested google.protobuf.Any messages to the google.protobuf.jsonformat.ParseDict function. This bypasses the intended recursion depth limit, leading to the exhaustion of Python’...

python: protobuf: Protobuf: Denial of Service due to recursion depth bypass

A flaw was found in protobuf. A remote attacker can exploit this denial-of-service DoS vulnerability by supplying deeply nested google.protobuf.Any messages to the google.protobuf.jsonformat.ParseDict function. This bypasses the intended recursion depth limit, leading to the exhaustion of Python’...

langextract-poc

LangExtract POC - Arquitectura Hexagonal Sistema de extracció...

GHSA-C3F3-CC42-XR9V Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy...

MSC-2026-6399

Malicious PyPI package that masquerades as a colorful console logger with emoji icons. On import it runs an infostealer: on Linux it appends an attacker-controlled SSH key to the user's authorizedkeys, then on all platforms it recursively harvests .env files and small .json files from every user...

KAVACHx

Intelligent Exploit & Patch Management Platform A full-stack...

CVE-2019-25449

OrientDB 3.0.17 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted JSON payloads to the document endpoint. Attackers can send POST requests to /document/demodb/-1:-1 with script tags in the name parameter to execute...

CVE-2026-27487

OpenClaw is a personal AI assistant. In versions 2026.2.13 and below, when using macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via security add-generic-password -w .... Because OAuth tokens are user-controlled data,...

Deserialization of Untrusted Data

Overview zumba/json-serializer is a Serialize PHP variables, including objects, in JSON format. Support to unserialize it too. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonSerializer::unserialize function. An attacker can execute arbitrary code...

CVE-2026-27206

Zumba Json Serializer is a library to serialize PHP variables in JSON format. In versions 3.2.2 and below, the library allows deserialization of PHP objects from JSON using a special @type field. The deserializer instantiates any class specified in the @type field without restriction. When...

CVE-2026-27206 Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()

Zumba Json Serializer is a library to serialize PHP variables in JSON format. In versions 3.2.2 and below, the library allows deserialization of PHP objects from JSON using a special @type field. The deserializer instantiates any class specified in the @type field without restriction. When...