CVE-2026-54592

A flaw was found in Oj, a Ruby gem for JSON parsing. A remote attacker can exploit this vulnerability by providing a deeply nested JSON document. This can lead to a stack buffer overflow in the Oj::Doceachchild function, causing the process to abort and resulting in a denial of service DoS for th...

CVE-2026-54903

A flaw was found in Oj, an Optimized JSON JavaScript Object Notation parser for Ruby. This vulnerability allows a remote attacker to cause heap corruption and a denial of service DoS by providing a JSON string larger than 2 gigabytes GB. An integer overflow occurs when processing the string lengt...

CVE-2026-54897

A flaw was found in Oj Optimized JSON, a Ruby gem for parsing JSON. This vulnerability, categorized as a heap use-after-free CWE-416, occurs in the Oj::Doc iterators, specifically eachvalue, eachchild, and eachleaf. An attacker could exploit this when a Ruby code block, executed during iteration,...

CVE-2026-54896

A flaw was found in Oj Optimized JSON, a Ruby gem used for processing JSON data. This vulnerability occurs when the software attempts to serialize convert into a format for storage or transmission Exception objects with a very large indentation setting. The internal process for handling this...

PYSEC-2026-827 jwcrypto token substitution can lead to authentication bypass

The JWT code can auto-detect the type of token being provided, and this can lead the application to incorrect conclusions about the trustworthiness of the token. Quoting the private disclosure we received : "Under certain circumstances, it is possible to substitute a .. signed JWS with a JWE that...

CVE-2026-48828

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for JSON-decodable variable values. An authenticated UI/API user...

CVE-2026-54899

A flaw was found in Oj Optimized JSON, a Ruby gem for parsing JSON. When a Oj::Parser instance is reused and its symbolkeys setting is toggled from true to false, a heap use-after-free vulnerability occurs. This happens because the internal key cache is freed but its pointer is not cleared,...

CVE-2026-48828

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based "shouldhidevalueforkey" check which triggers on secret-suffixed key names like "password" / "token" / "secret" could not fire for JSON-decodable variable values. An authenticated UI/A...

CVE-2026-48828 Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for JSON-decodable variable values. An authenticated UI/API user...

CVE-2026-48828

The Bulk Variables API in Apache Airflow fails to pass the variable's key to the redactor for JSON-decodable values. This causes the should_hide_value_for_key check to fail for keys ending in suffixes like *_password, *_token, or *_secret. Consequently, an authenticated user with bulk Variable re...

CVE-2026-48828 Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for JSON-decodable variable values. An authenticated UI/API user...

EUVD-2026-42028

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for JSON-decodable variable values. An authenticated UI/API user...

CVE-2026-48828 Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for JSON-decodable variable values. An authenticated UI/API user...

CVE-2026-48828

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for JSON-decodable variable values. An authenticated UI/API user...

PT-2026-56237

Name of the Vulnerable Software and Affected Versions Chevereto versions 3.7.5 through 4.5.3 Description An issue exists in the self-hosted media-sharing platform where the /json AJAX listing endpoint fails to enforce private profile restrictions. While the profile HTML route /username correctly...

Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

Summary An unauthenticated remote attacker can force any MCP Ruby SDK server using MCP::Server::Transports::StreamableHTTPTransport to allocate gigabytes of memory by sending a single oversized JSON-RPC POST. The transport reads the entire HTTP body into a Ruby String and parses it with...

ROS-20260707-73-0009

The vulnerability in jq is related to integer overflow. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-14803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path decodevalue...

Oracle Linux 9 : ruby:4.0 (ELSA-2026-33577)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-33577 advisory. - Fix Net::IMAP ResponseReader quadratic complexity vulnerability. CVE-2026-42245 Resolves: RHEL-181690 - Fix Net::IMAP STARTTLS stripping...

Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

Summary The stdio transports in MCP::Server::Transports::StdioTransport and MCP::Client::Stdio read newline-delimited JSON-RPC frames using IOgets with no limit argument. CRuby's IOgets with no limit reads from the current position until the next separator \n with no upper bound on the returned...