CVE-2026-52130: Uncontrolled Recursion

llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service...

CVE-2024-7952: Use of Hard-coded Credentials

A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data...

CVE-2026-84189: Improper Neutralization of Input During Web Page Generation

LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...

CVE-2026-83772: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function csetreportsdecode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is...

RockyLinux 9 : iperf3 (RLSA-2026:61389)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:61389 advisory. iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion CVE-2026-71217 Tenable has...

iperf3 security update

3.17.1-6.1 - Fix JSON value bounds checks in getparameters and iperfparsearguments CVE-2026-71217 - Resolves: RHEL-236170...

CVE-2026-52130

llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service...

PT-2026-84152

LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...

PT-2026-84119

Name of the Vulnerable Software and Affected Versions Cobham SATCOM VSAT7090 Maritime Satellite Router versions prior to 20260704 Description Command injection is possible via remote attack in the JSON Parsing component. The issue exists within the c set reports decode function of the...

CVE-2026-19032: Use of Externally-Controlled Input to Select Classes or Code

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

iperf3 security update

3.9-17.1 - Resolves: RHEL-236176 - Add JSON value checks for getparameters CVE-2026-71217...

MAL-2026-15819 Malicious code in @mrlegendbot/baileys (npm)

@mrlegendbot/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that silently makes the victim account follow attacker-chosen WhatsApp newsletter channels. lib/Socket/newsletter.js adds a startAutoFeatures function line 230 that is scheduled with setTimeout =...

PT-2026-84365

Name of the Vulnerable Software and Affected Versions llama.cpp versions prior to b5694 Description Uncontrolled recursion occurs in the common/json-schema-to-grammar.cpp file, which can lead to a denial of service. Uncontrolled recursion is a condition where a function calls itself without a...

CVE-2026-52130

llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service...

AlmaLinux 10 : iperf3 (ALSA-2026:61680)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:61680 advisory. iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion CVE-2026-71217 Tenable has...

AlmaLinux 9 : iperf3 (ALSA-2026:61389)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:61389 advisory. iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion CVE-2026-71217 Tenable has...

MiracleLinux 8 : iperf3-3.5-12.el8_10.1 (AXSA:2026-1717:05)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1717:05 advisory. iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion CVE-2026-71217 Tenable has...

RockyLinux 10 : iperf3 (RLSA-2026:61680)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:61680 advisory. iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion CVE-2026-71217 Tenable has...

CVE-2026-14368

The LwM2M JSON content formatter's getstring in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if stringlength buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...

CVE-2026-14368 Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser

The LwM2M JSON content formatter's getstring in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if stringlength buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...