CVE-2026-110684

A flaw was found in perl-Cpanel-JSON-XS. When encoding certain overloaded objects into string representations, under allowstringify, convertblessed or allowbignum, the encodestringify function retains unreleased references and fails to free allocated memory. An attacker capable of submitting...

SilkETW

SilkETW & SilkService SilkETW & SilkService are flexible C wrappers for ETW, they are meant to abstract away the complexities of ETW and give people a simple interface to perform research and introspection. While both projects have obvious defensive and offensive applications they should primaril...

CVE-2026-102946

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

UBUNTU-CVE-2026-102946

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

CVE-2026-102946

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

EUVD-2026-102310

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

CVE-2026-102946

The joserfc Python library, providing JOSE standards implementation, contains a JWS signature verification bypass in versions prior to 1.7.4 . The vulnerability exists because the joserfc.jws.deserialize_json() function incorrectly treats a JWS General JSON Serialization with an empty signatures ...

CVE-2026-102946 joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

CLEANSTART-2026-XX88554 undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON

Security vulnerability affects the n8n package. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON...

CLEANSTART-2026-OB90229 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

Security vulnerability affects the apache-nifi package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...

CLEANSTART-2026-PZ72315 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

CLEANSTART-2026-XJ20290 undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON

CVE-2026-84961 affects multiple packages. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. See references for individual vulnerability details...

Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in Apache Log4j

Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in Apache Log4j. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during...

CLEANSTART-2026-SN07875 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

CLEANSTART-2026-ON00136 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

Security vulnerability affects the sonarqube package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...

Security Bulletin: IBM Guardium Key Lifecycle Manager is affected by a security vulnerability (CVE-2026-49844)

Summary Security vulnerability has been addressed in IBM Guardium Key Lifecycle Manager Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. Th...

CLEANSTART-2026-KK56976 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to Improper Encoding due to Apache Log4j (CVE-2026-49844)

Summary Apache Log4j is shipped with IBM Tivoli Netcool Impact as part of its logging infrasture. Information about a security vulnerability affecting Apache Log4j has been published in a security bulletin. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite...

Security Bulletin: Security vulnerability in IBM Datacap

Summary This vulnerability, CVE-2026-49844, is addressed in IBM Datacap version 9.1.9 Interim Fix 009. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not...

CLEANSTART-2026-NT71796 undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON

Security vulnerability affects the langfuse package. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON...