CVE-2026-61534 Yayson: Prototype pollution in the Store/LegacyStore deserialization

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type i...

CVE-2026-66916

Omisión de Categorías Protegidas por Contraseña mediante Formato JSON en JoomGallery JoomGallery ≤ 4.3.0-stable — Un atacante no autenticado omite la barrera de contraseña para descargar imágenes protegidas RESUMEN Existe una omisión de control de acceso no autenticado en la vista JSON de...

SpringBreakVulnerableApp

Aplicación Vulnerable Spring Break Esta es una aplicación vulnerable para probar el exploit de la vulnerabilidad Spring Break CVE-2017-8046. ¡ADVERTENCIA! Esta aplicación contiene graves vulnerabilidades de seguridad. ¡Ejecútela bajo su propio riesgo! Se recomienda usar un entorno respaldado y...

CVE-2026-90715

A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravityjson.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been disclos...

CVE-2026-90714

A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravityjson.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been mad...

CVE-2019-18935

CVE-2019-18935 Telerik UI para ASP.NET AJAX RadAsyncUpload Handler Deserialización JSON en .NET Lista de versiones root@kitploit: 2007.1423 2007.1521 2007.1626 2007.2918 2007.21010 2007.21107 2007.31218 2007.31314 2007.31425 2008.1415 2008.1515 2008.1619 2008.2723 2008.2826 2008.21001 2008.31105...

EUVD-2026-77440

A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravityjson.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been disclos...

CVE-2026-90715 marcobambini Gravity udp json-parser gravity_json.c integer overflow

A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravityjson.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been disclos...

CVE-2026-90715

marcobambini Gravity up to version 0.9.7 is affected by an integer overflow in the udp json-parser component (file src/utils/gravity_json.c). The vulnerability can be triggered remotely without authentication or user interaction. A proof-of-concept exploit has been publicly disclosed. The issue i...

CVE-2026-90715 marcobambini Gravity udp json-parser gravity_json.c integer overflow

A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravityjson.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been disclos...

CVE-2026-90714 marcobambini Gravity JSON parser gravity_json.c memory corruption

A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravityjson.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been mad...

EUVD-2026-77436

A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravityjson.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been mad...

CVE-2026-90714

marcobambini Gravity (a Go-based HTTP server framework) versions up to 0.9.7 are affected by a memory corruption vulnerability in the JSON parser, specifically in the file src/utils/gravity_json.c. The exact function responsible is not identified in the provided documents. The vulnerability is ex...

CVE-2026-90714 marcobambini Gravity JSON parser gravity_json.c memory corruption

A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravityjson.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been mad...

Astra Linux – Vulnerability in Zabbix

The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files using zbxjsonopen...

Astra Linux – Vulnerability in cjson

In versions of cJSON 1.5.0 through 1.7.18, the decodearrayindexfrompointer function in cJSONUtils.c allows for out-of-bounds access. This enables remote attackers to bypass array bounds checking and access restricted data through malformed JSON pointer strings containing alphanumeric characters...

Astra Linux - Vulnerability in libfastjson

json-c through version 0.14 is vulnerable to an integer overflow and an out-of-bounds write when processing a large JSON file, as demonstrated by printbufmemappend...

Astra Linux – Vulnerability in python-jwcrypto

JWCrypto implements the JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker could cause a denial-of-service attack by passing in a malicious JWE Token with a high compression ratio. When the server processed this token, it would consume a lot of memory...

weblogicScanner

源工具链接：https://github.com/rabbitmask/WeblogicScan weblogicScaner 简体中文 | English 截至 2020 年 11 月 27 日，weblogic 漏洞扫描工具。若存在未记录且已公开 POC 的漏洞，欢迎提交 issue。 原作者已经收集得比较完整了，在这里做了部分的 bug 修复，部分脚本 POC 未生效，配置错误等问题。之前查了一下发现部分 POC 无法使用。在这个项目里面对脚本做了一些修改，提高准确率。 注意 ：部分漏洞由于稳定性原因需要多次测试才可验证 目前可检测漏洞编号有（部分非原理检测，需手动验证）：...

CVE-2026-42127

A flaw was found in Grafana. An unauthenticated attacker can exploit the public dashboard query endpoint by sending arbitrarily large JSON payloads. This vulnerability, caused by a lack of request body size limits, triggers excessive memory allocation, leading to a denial of service through memor...