CVE-2026-120367 Apache Axis2/Java: unbounded JSON request body buffering

Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust server memory with a large JSON reques...

CVE-2026-120367 Apache Axis2/Java: unbounded JSON request body buffering

Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust server memory with a large JSON reques...

CVE-2026-120367 Apache Axis2/Java: unbounded JSON request body buffering

Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust server memory with a large JSON reques...

CVE-2026-121616

A vulnerability was identified in Linksys E5600 1.1.0.26. Affected by this vulnerability is the function strcpy of the file /cgi-bin/meshlogin.cgi of the component JSON Request Parser. The manipulation of the argument username/password/token/source/cn/action leads to out-of-bounds write. The atta...

CVE-2026-121616 Linksys E5600 JSON Request mesh_login.cgi strcpy out-of-bounds write

A vulnerability was identified in Linksys E5600 1.1.0.26. Affected by this vulnerability is the function strcpy of the file /cgi-bin/meshlogin.cgi of the component JSON Request Parser. The manipulation of the argument username/password/token/source/cn/action leads to out-of-bounds write. The atta...

CVE-2026-121616

A vulnerability exists in the Linksys E5600 (version 1.1.0.26) within the JSON Request Parser component. The root cause is the use of the strcpy function in the /cgi-bin/mesh_login.cgi file, which allows an out-of-bounds write when an attacker manipulates the username, password, token, source, cn...

Linux Distros Unpatched Vulnerability : CVE-2026-114457

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body...

DEBIAN-CVE-2026-114457

A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated...

CVE-2026-114457

A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated...

EUVD-2026-108021

A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated...

PT-2026-121289

A flaw was found in mod qos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated...

CVE-2026-114457

A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated...

Uncontrolled Resource Consumption

Apache Struts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unrestricted reading of JSON request bodies into memory despite the configurable input length limit, which allows an attacker to submit an oversized JSON request and exhaust the application's heap, causi...

CVE-2026-82468

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...

CVE-2026-82468: Cross-Site Request Forgery (CSRF)

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...

CVE-2026-73633

Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny...

CVE-2026-49143

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContex...

PT-2026-38593

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21 Description An unauthenticated attacker can cause service disruption by sending crafted requests containing deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parses...

PT-2026-37190

Name of the Vulnerable Software and Affected Versions n8n-mcp versions prior to 2.47.13 Description When running in HTTP transport mode, authenticated tools/call requests have their full arguments and JSON-RPC parameters written to server logs by the request dispatcher and related code paths befo...

📄 Eclipse Che WebSocket Machine-Exec Remote Code Execution

This Python script is a WebSocket-based client designed to interact with an Eclipse Che / DevSpaces machine-exec service and test for an unauthenticated remote code execution vulnerability...