CVE-2026-78416: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interprete...

CVE-2025-63080: Incorrect Authorization

Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...

MiracleLinux 9 : grafana-10.2.6-23.el9_8.1 (AXSA:2026-1633:24)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1633:24 advisory. grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads CVE-2026-42127 Tenable has extracted the preceding description...

PT-2026-80909

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.18.1 Craft CMS versions 5.0.0-RC1 through 5.10.5 Description An authenticated remote code execution issue exists in the control panel element-search condition handling. A JSON cleanse bypass in...

PT-2026-80800

Name of the Vulnerable Software and Affected Versions KAON PG5298A versions prior to 3.0.82 KAON PG5298B versions prior to 4.0.82 Description Authenticated users can send crafted JSON-RPC requests to perform unauthorized operations that are not available through the graphical user interface, such...

PT-2026-81072

Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Fabric.js. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on t...

CVE-2026-78207: Improperly Controlled Modification of Object Prototype Attributes

exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject proto, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious proto property to cell notes, modifying Object.prototype and affecting...

Vim: Use-after-free in JSON Decoding

...

Exploit for CVE-2026-66916

Password-Protected Category Bypass via JSON Format in JoomGall...

ROOT-OS-DEBIAN-11-CVE-2024-42230 CVE-2024-42230 in linux - Patched by Root

Root has patched CVE-2024-42230 in the linux package for Root:Debian:11. Multiple fixed versions available...

MiracleLinux 8 : grafana-9.2.10-32.el8_10.1 (AXSA:2026-1616:23)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1616:23 advisory. grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33377 grafana: Grafana: Denial of Service due to excessive memory allocation...

Duplicate Advisory: Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rf74-v2fm-23pw. This link is maintained to preserve external references. Original Description NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows...

GHSA-CV2G-M8RR-888C Duplicate Advisory: Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rf74-v2fm-23pw. This link is maintained to preserve external references. Original Description NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows...

PYSEC-0000-CVE-2026-66393

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

PYSEC-2026-3724

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

CVE-2026-66393

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

EUVD-2026-64310

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

CVE-2026-66393 NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

CVE-2026-66393

NLTK versions before 3.9.4 are affected by an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() . An attacker can supply a deeply nested JSON structure that exceeds Python's recursion limit, triggering an unhandled RecursionError that crashes the process, resulting in denial of ...

CVE-2026-66393 NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...