60364 matches found
CVE-2026-56747: Improper Control of Generation of Code
Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...
PT-2026-65051
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callback mode=direct configured are vulnerable to XSS via the error description parameter on the page for a failed...
CVE-2026-51297
This CVE entry is rejected/not used and does not represent an active vulnerability.
CVE-2026-51298
Summary of findings (CVE-2026-51298) : Several connected advisories confirm a use-after-free vulnerability in SQLite 3.41 related to the JSON extraction function. The flaw occurs when, after releasing the JsonParse object with jsonParseFree(), the code still accesses internal members of the freed...
EUVD-2026-49352
sqlite 3.41 has a use-after-free vulnerability in the JSON parsing logic. Remote adversaries can craft malicious JSON payload to trigger memory free followed by illegal memory access, which may lead to arbitrary code execution, sensitive information leakage and service denial...
CVE-2026-51296
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51297
sqlite 3.41 has a use-after-free vulnerability in the JSON parsing logic. Remote adversaries can craft malicious JSON payload to trigger memory free followed by illegal memory access, which may lead to arbitrary code execution, sensitive information leakage and service denial...
Linux Distros Unpatched Vulnerability : CVE-2026-17501
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the...
CVE-2026-51296
SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information...
CVE-2026-60718
Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON. Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged...
CVE-2026-60194
Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON Duality. Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high...
CVE-2026-61109
Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily...
Exploit for Missing Authentication for Critical Function in Cpanel
cPanel-CVE-2026-41940-auth-bypass-exploit Critical authenticat...
Malicious code in @antstackio/json-to-graphql (npm)
Source: amazon-inspector b8602af1c076497f0aec4cec65fb012f2646c78c8c97f0fa8b234d5ef638fa6d The package @antstackio/json-to-graphql was found to contain malicious code. Source: google-open-source-security a794210601d9e5b1ef92c7aeda3d35fc71941ed078d56db6265c5a20c3dfaf2a This package was compromised ...
WordPress Kirki CVE-2026-8206 detection
Detects Kirki Freeform Page Builder and flags versions 6.0.0–6.0.6 affected by CVE-2026-8206: CompLibFormHandler accepts an attacker-controlled email on POST /wp-json/KirkiComponentLibrary/v1/kirki-forgot-password, redirecting password-reset links. Fixed in 6.0.7+. !/usr/bin/env python3 -- coding...
mcpsnoop v0.15.0
Wireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal. The problem The official MCP Inspector connects as its own client, so it never sees what your client Cursor, Claude Code, Codex actually sends your server. An...
No title provided
A flaw was found in sqlite. This use-after-free vulnerability in the JSON parsing logic allows remote attackers to craft malicious JSON payloads. This can trigger memory deallocation followed by illegal memory access, potentially leading to arbitrary code execution, sensitive information leakage,...
Sensitive Information Disclosure
n8n is vulnerable to Sensitive Information Disclosure. The vulnerability is due to placing the full Google Service Account PEM private key in the JWT header's kid field instead of a key identifier, which allows an attacker to recover the private key from logged or intercepted JWTs and impersonate...
mcpsnoop v0.14.0
Wireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal. The problem The official MCP Inspector connects as its own client, so it never sees what your client Cursor, Claude Code, Codex actually sends your server. An...