CLEANSTART-2026-DL13850 PyJWT is a Python implementation of JSON Web Token standards

CVE-2026-102269 affects multiple packages. PyJWT is a Python implementation of JSON Web Token standards. See references for individual vulnerability details...

CLEANSTART-2026-ON24571 jackson-databind binds a JSON string to a javax

CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...

CLEANSTART-2026-OB90229 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

Security vulnerability affects the apache-nifi package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...

CLEANSTART-2026-HQ66440 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)

Security vulnerability affects the apache-nifi package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...

CVE-2026-91136: Improper Limitation of a Pathname to a Restricted Directory

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...

spring-break_cve-2017-8046

spring-breakcve-2017-8046 Este es un programa Java que explota la vulnerabilidad Spring Break CVE-2017-8046. Este software está escrito para tener la menor cantidad de dependencias externas posible. AVISO LEGAL Esta herramienta está destinada a ingenieros de seguridad y profesionales de appsec pa...

ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

Summary The AoE3 POST /game/cloud/getFileURL handler in luskaner/ageLANServer's bundled game server decodes an attacker-controlled names JSON array and immediately allocates response storage sized directly from the array's length makei.A, lenreq.Names.Data, with no request body size limit and no...

GHSA-4JFQ-PMQ9-257H ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

Summary The AoE3 POST /game/cloud/getFileURL handler in luskaner/ageLANServer's bundled game server decodes an attacker-controlled names JSON array and immediately allocates response storage sized directly from the array's length makei.A, lenreq.Names.Data, with no request body size limit and no...

CVE-2026-52130

A flaw was found in llama.cpp. This vulnerability, caused by uncontrolled recursion in the common/json-schema-to-grammar.cpp component, allows an attacker to trigger a denial of service. This can lead to the affected system becoming unresponsive or unavailable. Mitigation Restrict or disable API...

CVE-2026-107839

ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the...

CVE-2026-107833

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can...

CVE-2026-107839

The ageLANServer software, which provides a cross-platform web server and launcher for Age of Empires and Age of Mythology games, is vulnerable to a Remote Denial of Service (DoS) . In versions prior to 1.15.2 , the AoE3 POST /game/cloud/getFileURL handler lacks a request body size limit and fail...

CVE-2026-107839 ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the...

CVE-2026-107839 ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the...

CVE-2026-107833 OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can...

CVE-2026-107833

The OWASP Coraza WAF library (versions 3.0.0 through 3.8.0 ) contains an unbounded recursion vulnerability in the ProcessResponse function located in internal/bodyprocessors/json.go. The root cause is that the ignoreJSONRecursionLimit value of -1 is passed to readJSON, while the recursive guard o...

CVE-2026-107833 OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can...

CVE-2026-107833 OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can...

CVE-2026-107826 OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An...

CVE-2026-107826

The OWASP Coraza WAF library (versions 3.0.0 to 3.8.1 ) is vulnerable to a stack overflow due to how the readJSON function in internal/bodyprocessors/json.go handles argument limits. When the bounded flattening walk reaches the SecArgumentsLimit or byte budget, it may still call gjson.Valid on th...