PT-2026-88986

PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and...

CVE-2023-54395: Inefficient Algorithmic Complexity

PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and...

CVE-2024-58381: Deserialization of Untrusted Data

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties,...

Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152

This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise...

PT-2026-89007

PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the...

Linux Distros Unpatched Vulnerability : CVE-2026-82054

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafte...

Linux Distros Unpatched Vulnerability : CVE-2026-82058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON...

The vulnerability of the JSON processing library and stream-json, related to algorithmic complexity, allows attackers to cause service failures.

The vulnerability of the JSON processing library and stream-json is related to algorithmic complexity. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-88982

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server...

CVE-2023-54390: Comparison Using Wrong Factors

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server...

PT-2026-89253

This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: iperf3 (UTSA-2026-106773)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106773 advisory. A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control- channel JSON with oversized numeric parameters, such as...

SUSE CVE-2026-84961

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

EUVD-2026-70737

node-csv: Prototype replacement still reachable via columns path...

GHSA-5QR2-V392-M9G8 SWC HTML minifier may allow script element breakout when minifying embedded JSON

Impact @swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value. Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal sequence, the generated HTML...

EUVD-2026-56179

SWC HTML minifier may allow script element breakout when minifying embedded JSON...

SWC HTML minifier may allow script element breakout when minifying embedded JSON

Impact @swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value. Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal sequence, the generated HTML...

CVE-2026-82058

A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path...

CVE-2026-82054

A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size,...

CVE-2026-82054

A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size,...