Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

Summary fromJSON and fromCrossJSON did not check that an array node's element list is an array. A small crafted payload could set the length the decoder used. That length controlled how much memory was allocated and how many times the decoder looped, and it did not depend on the size of the...

GHSA-WP97-X4HV-QVHP Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

Summary fromJSON and fromCrossJSON did not check that an array node's element list is an array. A small crafted payload could set the length the decoder used. That length controlled how much memory was allocated and how many times the decoder looped, and it did not depend on the size of the...

CVE-2026-118652

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripti...

CVE-2026-118652: Improper Neutralization of Input During Web Page Generation

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripti...

CVE-2021-21551

CVE-2021-21551 Simple PoC for exploiting CVE-2021-21551 for LPE by spawning system cmd. https://vulners.com/cve/CVE-2021-21551 An issue was discovered in signed dell windows driver dbutil23.sys which may lead to compromisation of whole local system. Driver's ioctl dispatch routine lacks of...

mitv4-utgard-lpe

MiTV4 Amlogic Utgard — local privilege escalation via unvali...

CVE-2026-116584 Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled...

Linux Distros Unpatched Vulnerability : CVE-2026-93523

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.1...

UBUNTU-CVE-2026-86471

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and...

ROS-20261023-73-0169

The vulnerability in libxml2 is related to an unvalidated return value. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-114647

The MongoDB C# Driver is vulnerable to a NoSQL operator injection because the FindOneAndReplace operation fails to reject replacement documents with top-level field names starting with a dollar sign ($) . If an application constructs such a document using user-supplied field names , an attacker c...

CVE-2026-114647 NoSQL operator injection via unvalidated replacement document in findOneAndReplace

The MongoDB C Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a...

CVE-2026-114647 NoSQL operator injection via unvalidated replacement document in findOneAndReplace

The MongoDB C Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a...

CVE-2026-114643 Duplicate geometry fields via unvalidated GeoJSON extra members

The MongoDB C Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the serve...

CVE-2026-114643

The MongoDB C# Driver is vulnerable to a collision issue where it writes GeoJSON extra members without verifying if their names conflict with reserved members like type or coordinates. If an application allows user-supplied field names in these extra members, it can result in documents with dupli...

Duplicate geometry fields via unvalidated GeoJSON extra members

The MongoDB C Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the serve...

CVE-2026-114643 Duplicate geometry fields via unvalidated GeoJSON extra members

The MongoDB C Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the serve...

GHSA-C4QX-W738-7HR3 GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/utils npm, pkg:github/ardatan/graphql-tools | | Repository | https://github.com/ardatan/graphql-tools | | Component | mergeIncrementalResult / setObjectKeyPath packages/utils/src/mergeIncrementalResult.ts | | Vulnerability...

GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/utils npm, pkg:github/ardatan/graphql-tools | | Repository | https://github.com/ardatan/graphql-tools | | Component | mergeIncrementalResult / setObjectKeyPath packages/utils/src/mergeIncrementalResult.ts | | Vulnerability...

SSRF and local file disclosure via unvalidated URLs

Applications that pass attacker-controlled URLs to webpage versions before 2.1.0 may be vulnerable to server-side request forgery SSRF or local file disclosure. HTTP::fetch and Webpage::fromurl passed URLs to libcurl without restricting the URL scheme or validating the resolved destination IP...