CVE-2026-29975

The lwjson library (version 1.8.1 ) contains an improper input validation vulnerability in its streaming JSON parser, specifically within lwjson_stream.c . The root cause is a logical error where the end-of-string detection logic only checks the immediately preceding character instead of counting...

CVE-2026-33442

Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the sanitizeStringLiteral method in Kysely's query compiler escapes single quotes ' → '' but does not escape backslashes. On MySQL with the default BACKSLASHESCAPES SQL mode, an attacker can inject a backslash...