CVE-2026-30826

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3...

CVE-2026-77415

JSONata (a JSON query and transformation language) is vulnerable to arbitrary code execution in versions prior to 1.8.8 and 2.2.1 . An attacker can craft JSONata expressions that chain multiple object-integrity weaknesses—overwriting $clone, exposing internal functions via $merge.*, replacing pro...

kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

Summary An uncontrolled resource consumption vulnerability in openapi3filter lets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares a deepObject-style query parameter whose schema contains an array a normal, documented pattern,...

GHSA-XHJ3-7XW9-VR34 kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

Summary An uncontrolled resource consumption vulnerability in openapi3filter lets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares a deepObject-style query parameter whose schema contains an array a normal, documented pattern,...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value through sliceMapToSlice in openapi3filter/reqrespdecoder.go. An attacker can force multi-gigabyte heap allocation and a denial of service by sending a deepObject query parameter with a large...

Keystone vulnerable to `graphql.maxTake` bypass with negative `take`

Summary The value of graphql.maxTake can be bypassed by providing a negative input. This can be used to exceed the developer's intended graphql.maxTake value, allowing queries to return results in excess of the graphql.maxTake value set. Impact This affects any project relying on graphql.maxTake ...

GHSA-CQMQ-8755-7XVH Keystone vulnerable to `graphql.maxTake` bypass with negative `take`

Summary The value of graphql.maxTake can be bypassed by providing a negative input. This can be used to exceed the developer's intended graphql.maxTake value, allowing queries to return results in excess of the graphql.maxTake value set. Impact This affects any project relying on graphql.maxTake ...

CVE-2026-77354 kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/reqrespdecoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the large...

CVE-2026-77354

kin-openapi (Go library for OpenAPI file handling) versions 0.124.0 through 0.142.0 are affected by an uncontrolled resource consumption vulnerability in openapi3filter.sliceMapToSlice (req_resp_decoder.go). The function converts attacker-controlled sparse indexes from a deepObject query paramete...

CVE-2026-77354 kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/reqrespdecoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the large...

CVE-2026-77354

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/reqrespdecoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the large...

CVE-2026-77810

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...

CVE-2026-67359

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orderid as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals...

CVE-2026-30826 Combodo iTop: Reflected XSS in run_query.php

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3...

CVE-2026-30826 Combodo iTop: Reflected XSS in run_query.php

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3...

EUVD-2026-64135

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3...

CVE-2026-30826

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3...

CVE-2026-30826

Combodo iTop is a web-based IT service management tool. Prior to version 3.2.3 , a Reflected Cross-Site Scripting (XSS) vulnerability exists in the testing OQL query functionality of run_query.php. An attacker with low privileges can craft a malicious link that, when clicked by a user, executes a...

CVE-2026-30826 Combodo iTop: Reflected XSS in run_query.php

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3...

CVE-2026-77810 Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...