CVE-2026-9516

The Cpanel::JSON::XS Perl module (versions before 4.41 ) is vulnerable to a Denial of Service (DoS) attack. The root cause lies in the decode_json() function, which advances the string pointer of an input scalar to skip a leading 3-byte UTF-8 BOM but fails to restore that pointer if the decoding ...

CVE-2026-9516

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

Cpanel::JSON::XS security vulnerability

Cpanel::JSON::XS is a tool developed by RURBAN personal developers that converts Perl data structures into JSON format. Versions of Cpanel::JSON::XS prior to version 4.41 contained security vulnerabilities. These vulnerabilities stemmed from exceptions thrown during the decoding filter callback,...

CVE-2026-9516: Release of Invalid Pointer or Reference

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

PT-2026-45892

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.41 Description An issue exists where providing input prefixed with a UTF-8 Byte Order Mark BOM can lead to a denial of service. When the decode json function processes a 3-byte UTF-8 BOM, it advances the...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.19), org.gatein.pc:pc-test-servers-tomcat7 (>=2.4.0.alpha03, <=2.5.1.final) +2 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (7.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.19 -...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.20), org.jboss.arquillian.container:arquillian-tomcat-embedded-7 (>=1.0.0.cr4, <=1.0.0.cr6) +2 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (7.0.20)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.20 -...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.20), org.jboss.arquillian.container:arquillian-tomcat-embedded-7 (>=1.0.0.cr4, <=1.0.0.cr6) +2 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (7.0.20)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.20 -...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.20), org.jboss.arquillian.container:arquillian-tomcat-embedded-7 (>=1.0.0.cr4, <=1.0.0.cr6) +2 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (7.0.20)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.20 -...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.19), org.gatein.pc:pc-test-servers-tomcat7 (>=2.4.0.alpha03, <=2.5.1.final) +2 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (7.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.19 -...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.19), org.gatein.pc:pc-test-servers-tomcat7 (>=2.4.0.alpha03, <=2.5.1.final) +2 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (7.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.19 -...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.20), org.jboss.arquillian.container:arquillian-tomcat-embedded-7 (>=1.0.0.cr4, <=1.0.0.cr6) +2 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (7.0.20)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.20 -...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.19), org.gatein.pc:pc-test-servers-tomcat7 (>=2.4.0.alpha03, <=2.5.1.final) +2 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (7.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.19 -...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.19), org.gatein.pc:pc-test-servers-tomcat7 (>=2.4.0.alpha03, <=2.5.1.final) +2 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (7.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.19 -...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.20), org.jboss.arquillian.container:arquillian-tomcat-embedded-7 (>=1.0.0.cr4, <=1.0.0.cr6) +2 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (7.0.20)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.20 -...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.20), org.jboss.arquillian.container:arquillian-tomcat-embedded-7 (>=1.0.0.cr4, <=1.0.0.cr6) +2 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (7.0.20)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.20 -...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.19), org.gatein.pc:pc-test-servers-tomcat7 (>=2.4.0.alpha03, <=2.5.1.final) +2 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (7.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.19 -...

com.abavilla:fpi-bot-api (>=1.0.2, <=1.1.0), com.abavilla:fpi-bot-api-core (>=1.0.2, <=1.1.0) +136 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.12.3.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.12.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.abavilla:fpi-bot-api =1.0.2, =1.0.2, =1.0.2, =1.0.132, =v1.3.1, =v1.3.1, =1.0.42, =1.0.42,...

bugbug (0.0.593), chatlas-chains (>=0.1.3, <=0.3.3) +4 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.32)

langchain-openai PYPI version 0.3.32 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - bugbug 0.0.593 - chatlas-chains =0.1.3, =1.0.0, =0.1.8, =0.0.86, =0.0.92 Source cves: CVE-2026-41488 Source advisory:...

bugbug (0.0.593), chatlas-chains (>=0.1.3, <=0.3.3) +4 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.32)

langchain-openai PYPI version 0.3.32 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - bugbug 0.0.593 - chatlas-chains =0.1.3, =1.0.0, =0.1.8, =0.0.86, =0.0.92 Source cves: CVE-2026-41488 Source advisory:...