Astra Linux – Vulnerability in json-smart

A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4, which causes a denial of service DOS through a crafted web request...

Astra Linux – Vulnerability in yajl

In the yajl-ruby gem version 1.3.0 for Ruby, when a properly crafted JSON file is provided to Yajl::Parser.new.parse, the entire Ruby process crashes with a SIGABRT in the yajlstringdecode function in yajlencode.c. This causes the entire Ruby process to terminate, potentially leading to a denial ...

Astra Linux – Vulnerability in ModSecurity-Apache

ModSecurity is an open-source, cross-platform Web Application Firewall WAF engine for Apache, IIS, and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in a specific scenario: when the payload’s content type is application/json, and there is at least one rule that...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The values and valueslist methods on models with a JSONField are vulnerable to SQL injection when column aliases are used, due to a crafted JSON object key being passed as an argument...

Astra Linux – Vulnerability in cjson

In cJSON before version 1.7.18, parsestring has a heap-based buffer over-read issue, occurring through "1":1, without any trailing newline characters when cJSONParseWithLength is called...

Security Bulletin: IBM Guardium Key Lifecycle Manager is affected by a security vulnerability (CVE-2026-49844)

Summary Security vulnerability has been addressed in IBM Guardium Key Lifecycle Manager Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. Th...

CVE-2026-105676: Improper Limitation of a Pathname to a Restricted Directory

Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is...

PT-2026-106188

Name of the Vulnerable Software and Affected Versions Ghost versions 1.20.0 through 6.63.0 Description An issue in the way theme translation files are loaded allows an authenticated Administrator to read JSON files located outside of the active theme directory, which could lead to the exposure of...

Linux Distros Unpatched Vulnerability : CVE-2026-104056

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a...

Security Bulletin: Vulnerability reported in jackson-core-2.18.6.jar for APIM 11.1 is now addressed

Summary Vulnerability reported in jackson-core-2.18.6.jar for APIM 11.1 is now addressed Vulnerability Details CVEID:CVE-2026-68494 DESCRIPTION: The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is...

CVE-2026-78903-SWIFT-Kick-to-the-Creds

CVE-2026-78903 — SWIFT 자격 증명에 대한 킥 SWIFT API 게이트웨이 JWT 알고리즘 혼동 필드| 값 ---|--- 심각도| 9.1 치명적 공격 경로| 네트워크 영향받는 버전| 3.2.0 – 3.2.4 발견자| 𝕍𝕠𝕤𝕤🥷 설명 SWIFT API 게이트웨이의 치명적인 잘못된 구성으로 인해 공격자가 서버가 RS256을 기대하는 동안 HS256 알고리즘을 사용하여 JWT를 위조할 수 있습니다. 서버는 공개 RSA 키를 HMAC 비밀 키로 사용하여 토큰을 잘못 검증하므로, 공격자가 유효한 관리자 토큰을 위조할 수...

CVE-2026-105134

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack...

EUVD-2026-92078

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack...

CVE-2026-105134 Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack...

EUVD-2026-92047

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105125

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105125: Improper Limitation of a Pathname to a Restricted Directory

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105125 LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105125

LaraDashboard versions prior to 1.4.8 are vulnerable to a path traversal vulnerability within the /api/translations/{lang} endpoint. This flaw allows unauthenticated attackers to read sensitive JSON files, such as composer.json, by manipulating the {lang} route segment. Specifically, on Windows h...

CVE-2026-105125 LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...