pgadmin4-9.10-CVE-2025-13780

pgadmin4 9.11 Meta-Command Filter Command Execution Summary The PLAIN restore meta-command filter introduced in pgAdmin as part of the fix for Issue 9320 does not detect meta-commands when a SQL file begins with a UTF-8 Byte Order Mark EF BB BF or other special sequences. The implemented filter...

CVE-2026-109347 Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PH...

CVE-2026-109347 Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PH...

CVE-2026-109347 Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PH...

CVE-2026-109347

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PH...

CVE-2026-109347

The Adminer software (versions before 6.1.1 ) is vulnerable to a Remote Code Execution (RCE) flaw when using SQLite . The root cause is a bypass of ATTACH and VACUUM INTO restrictions, achieved by prefixing statements with a UTF-8 byte-order mark . Authenticated users can exploit this to attach a...

PYSEC-2026-4150 PyJWT BOM Bypass

Affected Package - Package: PyJWT pyjwt on PyPI - Repository: https://www.google.com/url?q=https://github.com/jpadilla/pyjwt&source=gmail&ust=1781794518474000&sa=E - Affected version: 2.13.0 - Vulnerability class: Algorithm confusion / patch bypass --- Root Cause PyJWT 2.13.0 introduced a guard i...

PyJWT BOM Bypass

Affected Package- Package: PyJWT pyjwt on PyPI- Repository: https://www.google.com/url?q=https://github.com/jpadilla/pyjwt=gmail=1781794518474000=E- Affected version: 2.13.0- Vulnerability class: Algorithm confusion / patch bypass--- Root CausePyJWT 2.13.0 introduced a guard in...

AZL-105224 CVE-2026-102272 affecting package python-jwt 2.13.0-1

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with ...

DEBIAN-CVE-2026-102272

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with ...

CVE-2026-102272

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with ...

CVE-2026-102272

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with ...

EUVD-2026-88540

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with ...

CVE-2026-102272

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with ...

OESA-2026-2588 perl-Cpanel-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. Security Fixes: Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys whe...

OESA-2026-2589 perl-Cpanel-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. Security Fixes: Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys whe...

AZL-89399 CVE-2026-9516 affecting package perl-Cpanel-JSON-XS 4.39-1

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

CVE-2026-9516

The Cpanel::JSON::XS Perl module (versions before 4.41 ) is vulnerable to a Denial of Service (DoS) attack. The root cause lies in the decode_json() function, which advances the string pointer of an input scalar to skip a leading 3-byte UTF-8 BOM but fails to restore that pointer if the decoding ...

CVE-2026-9516

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

CVE-2026-9516: Release of Invalid Pointer or Reference

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...