Security Bulletin: Multiple Vulnerabilities affects IBM Data Studio Client 4.2.3

Summary Security Fix of multiple Vulnerabilities of IBM Data Studio Client 4.2.3. The vulnerabilities have been addressed in 4.2.3 version. Hence, IBM strongly recommends upgrading to 4.2.3. Vulnerability Details CVEID:CVE-2026-18401 DESCRIPTION: The non-blocking asynchronous JSON parser in...

CVE-2026-17609

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submitform function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...

SQL Injection

Payload CMS is vulnerable to SQL Injection. The vulnerability is due to improper validation of crafted field paths and operators in collections containing JSON fields or blocks with blocksAsJSON enabled, which allows an authenticated attacker with read and create or update permissions to inject...

CVE-2026-17609 Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submitform function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...

EUVD-2026-94736

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submitform function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...

CVE-2026-17609 Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submitform function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...

CVE-2026-17609

The Super Forms WordPress plugin (versions up to and including 6.3.316 ) is vulnerable to unauthenticated arbitrary directory deletion . The flaw exists in the submit_form function due to insufficient validation of attacker-controlled JSON field declarations against the form schema. Specifically,...

CLEANSTART-2026-PZ72315 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

CLEANSTART-2026-IX04206 Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS)

Security vulnerability affects the apache-hive package. Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS...

CLEANSTART-2026-VO44592 Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS)

Security vulnerability affects the apache-hive package. Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS...

CLEANSTART-2026-XJ20290 undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON

CVE-2026-84961 affects multiple packages. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. See references for individual vulnerability details...

CLEANSTART-2026-QQ14312 jackson-databind binds a JSON string to a javax

CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...

CVE-2026-105672: Improper Authentication

TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without...

PT-2026-108015

🚨 CVE-2026-14999 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures...

CVE-2026-44037: Uncontrolled Recursion

Uncontrolled mutual recursion between DcmJSONReader::parseDataSet, DcmJSONReader::parseElement and DcmJSONReader::parseSequence in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted DICOM JSON document...

PT-2026-108282

Name of the Vulnerable Software and Affected Versions TP-Link Tapo C325WB V2 affected versions not specified Description An unauthenticated authorization bypass exists in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can bypass session verification and execute...

PT-2026-107809

Name of the Vulnerable Software and Affected Versions Super Forms – Drag & Drop Form Builder versions prior to 6.3.317 Description An issue exists in the submit form function that allows unauthenticated attackers to recursively delete arbitrary directories on the server, including the WordPress...

PT-2026-109279

Name of the Vulnerable Software and Affected Versions OWASP Coraza WAF versions 3.0.0 through 3.7.x Description An issue exists in the JSON response body processor where the ProcessResponse function in internal/bodyprocessors/json.go fails to enforce a recursion limit. It passes a value of -1 to...

PT-2026-107999

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset key...

CVE-2026-14999: Improper Verification of Cryptographic Signature

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures...