CVE-2026-8623 Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent class attribute of .dvcss element' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...

EUVD-2026-70533

A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate method only performed semantic validation when the supplied definition was...

CVE-2026-85239

MISP is vulnerable to a validation bypass in its event template handling. The EventTemplate::beforeValidate() method only applied semantic validation when the definition was already an array; a caller supplying a pre-encoded string (including malformed JSON ) bypassed validateDefinition() and onl...

PT-2026-70247

Name of the Vulnerable Software and Affected Versions Vim versions 9.2.0511 through 9.2.0843 Description The json decode item function in src/json.c can retain a stale pointer after json decode string calls channel fill to refill and free the current buffer. This occurs when an invalid JSON strin...

GHSA-RVXJ-7F72-MHRX EGroupware has SQL Injection in Nextmatch Filter Processing

Summary Critical Authenticated SQL Injection in Nextmatch Widget Filter Processing A critical SQL Injection vulnerability exists in the core components of EGroupware, specifically in the Nextmatch filter processing. The flaw allows authenticated attackers to inject arbitrary SQL commands into the...

EUVD-2023-38439

Malicious code in bioql PyPI...

open62541:fuzz_json_decode: Heap-buffer-overflow in removeFieldFromEncoding

Project: https://github.com/open62541/open62541.git Detailed Report: https://oss-fuzz.com/testcase?key=5133430696509440 Project: open62541 Fuzzing Engine: libFuzzer Fuzz Target: fuzzjsondecode Job Type: libfuzzerasanopen62541 Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Addres...

open62541:fuzz_json_decode: Negative-size-param in removeFieldFromEncoding

Project: https://github.com/open62541/open62541.git Detailed Report: https://oss-fuzz.com/testcase?key=6046017237090304 Project: open62541 Fuzzing Engine: libFuzzer Fuzz Target: fuzzjsondecode Job Type: libfuzzerasanopen62541 Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash...

open62541:fuzz_json_decode: Crash in parseDouble

Project: https://github.com/open62541/open62541.git Detailed Report: https://oss-fuzz.com/testcase?key=6364803344236544 Project: open62541 Fuzzing Engine: libFuzzer Fuzz Target: fuzzjsondecode Job Type: libfuzzerasanopen62541 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x6140000100...

PHP Library Remote Code Execution Vulnerability

Several PHP compatibility libraries contain a potential remote code execution flaw in their jsondecode function based on having copy pasted existing vulnerable code. Affected components include the WassUp Realtime analytics WordPress plugin, AjaXplorer Core, and more. JAHx221 - RCE in copy/pasted...

open62541:fuzz_json_decode_encode: Heap-buffer-overflow in extensionObjectOrder

Project: https://github.com/open62541/open62541.git Detailed Report: https://oss-fuzz.com/testcase?key=5663845975195648 Project: open62541 Fuzzing Engine: afl Fuzz Target: fuzzjsondecodeencode Job Type: aflasanopen62541 Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

Unhandled exception when decoding form response JSON

Impact When handling form responses from the client ModalFormResponsePacket, the Minecraft Windows client may send weird JSON that jsondecode can't understand. A workaround for this is implemented in InGamePacketHandler::stupidjsondecode. An InvalidArgumentException is thrown by this function whe...

PT-2022-28287

Name of the Vulnerable Software and Affected Versions Minecraft Windows client affected versions not specified Description The issue arises when the Minecraft Windows client sends malformed JSON in form responses, which the json decode function cannot parse. A workaround, implemented in the...

PT-2021-27672

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of "Use-of-uninitialized-value" as reported by OSS-Fuzz. The crash occurs in the fuzz json decode encode.cc file,...

open62541:fuzz_json_decode_encode: Use-of-uninitialized-value in fuzz_json_decode_encode.cc

Project: https://github.com/open62541/open62541.git Detailed Report: https://oss-fuzz.com/testcase?key=6699708436316160 Project: open62541 Fuzzing Engine: libFuzzer Fuzz Target: fuzzjsondecodeencode Job Type: libfuzzermsanopen62541 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

open62541:fuzz_json_decode_encode: Heap-buffer-overflow in jumpOverRec

Detailed Report: https://oss-fuzz.com/testcase?key=4963278934638592 Project: open62541 Fuzzing Engine: honggfuzz Fuzz Target: fuzzjsondecodeencode Job Type: honggfuzzasanopen62541 Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x628000003f80 Crash State: jumpOverRec...

PT-2020-22459

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 4 crash occurred, involving the Variant decodeJson and UA decodeJson functions in the fuzz json decode encode.cc file...

WS-2019-0516

open62541 before v1.0.1 and in v1.1-dev is vulnerable to use-of-uninitialized-value in json decode on src/uatypesencodingjson.c...

DEBIAN-CVE-2016-9854

An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the expo...

ALPINE-CVE-2016-9854

An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the expo...