CVE-2026-107826 OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An...

CVE-2026-107826 OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An...

BIT-GHOST-2026-104417 Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposin...

Ch4120N-CVE-Pulse

⚡ Ch4120N CVE Pulse Live CVE PoC Aggregator with Smart Search & Threat Intelligence CVE Pulse automatically discovers, scores, and indexes CVE Proof‑of‑Concepts from GitHub. It enriches them with EPSS scores and CISA KEV data, builds daily snapshots & diffs, and serves a fast, searchable static...

CVE-2026-104635

A flaw was found in protobuf. An unauthenticated remote attacker can trigger a Denial of Service DoS by submitting a deeply nested JSON document to an application configured to decode self-referential message types. Because the decoder fails to enforce recursion limits on these structures,...

CVE-2026-104635 Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages

Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3,...

CVE-2026-104635 Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages

Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3,...

EUVD-2026-95562

Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3,...

CVE-2026-104635

The elixir-protobuf library (version 0.8.0 and onward) is vulnerable to uncontrolled recursion during JSON decoding. Specifically, the Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, and Protobuf.JSON.from_decoded/3 functions fail to increment or check the depth counter when processing user-defi...

EEF-CVE-2026-104635 Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages

Summary Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3,...

novahot

novahot novahot es un framework de webshell para testers de penetración. Implementa una API basada en JSON que puede comunicarse con troyanos escritos en cualquier lenguaje. Por defecto, incluye troyanos escritos en PHP, Ruby y Python. Además de ejecutar comandos del sistema, novahot puede emular...

EUVD-2026-95405

TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without...

Linux Distros Unpatched Vulnerability : CVE-2026-44037

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled mutual recursion between DcmJSONReader::parseDataSet, DcmJSONReader::parseElement and DcmJSONReader::parseSequence in dcmdata/libsrc/dcjsonrd.cc of...

Linux Distros Unpatched Vulnerability : CVE-2026-104635

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process...

CVE-2026-107833: Uncontrolled Recursion

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can...

CVE-2026-107839: Uncontrolled Resource Consumption

ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the...

PT-2026-108772

Name of the Vulnerable Software and Affected Versions elixir-protobuf versions 0.8.0 through 0.17.0 Description An unauthenticated remote attacker can cause a crash of the decoding process by providing a deeply nested JSON document. This occurs when an application decodes attacker-supplied JSON...

PT-2026-109160

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposin...

CVE-2026-104635: Uncontrolled Recursion

Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3,...

VulnCheck KEV: CVE-2026-91136

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...