Malware in json-bundling

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview json-bundling is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

com.agorapulse:gru-micronaut (1.4.0), com.bertramlabs.plugins:asset-pipeline-grails (>=4.5.0, <=4.5.2) +184 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=3.9.0, <=3.10.4)

io.micronaut:micronaut-json-core MAVEN version =3.9.0, =4.5.0, =1.3.6, =1.30.0, =2.14.0, =2.12.0, =1.13.0, =0.1.0, =6.0.9, =6.0.10 - io.github.matrei:grails-inertia-plugin 2.0.0 and more Source cves: CVE-2026-33013 Source advisory: MEND:CVE-2026-33013...

com.agorapulse:micronaut-amazon-awssdk-dynamodb-loader (>=3.4.3, <=4.2.0), com.agorapulse:micronaut-amazon-awssdk-kinesis (>=3.4.3, <=4.2.0) +476 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=4.0.0-m1, <=4.10.15)

io.micronaut:micronaut-json-core MAVEN version =4.0.0-m1, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.5.1 and more Source cves: CVE-2026-33013 Source advisory: MEND:CVE-2026-33013...

com.agorapulse:micronaut-amazon-awssdk-cloudwatch (>=1.6.1-micronaut-3.0, <=2.2.2-micronaut-3.0), com.agorapulse:micronaut-amazon-awssdk-cloudwatchlogs (>=2.0.8-micronaut-3.0, <=2.2.2-micronaut-3.0) +448 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=3.1.0, <=3.8.12)

io.micronaut:micronaut-json-core MAVEN version =3.1.0, =1.6.1-micronaut-3.0, =2.0.8-micronaut-3.0, =1.6.1-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.2-micronaut-3.0, =2.0.0-micronaut-3.0, =1.7.2-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.1-micronaut-3.0,...

Malicious code in safe-json-parsex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c75827c4ff52be2152687faf186ee7a5668e9dd33bd30adfab490a5e2198c30 The package safe-json-parsex was found to contain malicious code. Source: ghsa-malware 4baa22d0d844650e1fcedcce52b117324903496e0d1399245674b48e4b3ae0...

MAL-2026-1968 Malicious code in safe-json-parsex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c75827c4ff52be2152687faf186ee7a5668e9dd33bd30adfab490a5e2198c30 The package safe-json-parsex was found to contain malicious code. Source: ghsa-malware 4baa22d0d844650e1fcedcce52b117324903496e0d1399245674b48e4b3ae0...

Malicious Package

Overview safe-json-parsex is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in safe-json-parsex

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in json-parse-genie

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview json-parse-genie is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1952 Malicious code in json-parse-genie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57744a9f0e3acf081bd2a75ca3684d01e3907f1eab7636e0873ed0ef1bf509ee The package json-parse-genie was found to contain malicious code. Source: ghsa-malware b2293df6ecd418ffd21c1112affa6571afe9a78ff596ce2dd1fac64a470c98...

Malicious code in json-parse-genie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57744a9f0e3acf081bd2a75ca3684d01e3907f1eab7636e0873ed0ef1bf509ee The package json-parse-genie was found to contain malicious code. Source: ghsa-malware b2293df6ecd418ffd21c1112affa6571afe9a78ff596ce2dd1fac64a470c98...

CVE-2026-32880

ChurchCRM is an open-source church management system. Versions prior to 7.0.2 allow an admin user to edit JSON type system settings to store a JavaScript payload that can execute when any admin views the system settings. The JSON input is left unescaped/unsanitized in SystemSettings.php, leading ...

ALPINE-CVE-2026-32874

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory leak in JSON parsing large outside of the range -2^63, 2^64 - 1 integers. The leaked memory is a copy of the string form of the integer plus a...

CVE-2026-32874

UltraJSON (ujson) for Python, C-based fast JSON encoder/decoder, is affected in versions 5.4.0–5.11.0 by a memory-leak in parsing large integers that fall outside [-2^63, 2^64-1]. The leak copies the integer’s string form plus an extra NULL byte and occurs regardless of whether the integer parses...

CVE-2026-32874

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory leak in JSON parsing large outside of the range -2^63, 2^64 - 1 integers. The leaked memory is a copy of the string form of the integer plus a...

CVE-2026-32874 UltraJSON has a Memory Leak parsing large integers allows DoS

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory leak in JSON parsing large outside of the range -2^63, 2^64 - 1 integers. The leaked memory is a copy of the string form of the integer plus a...

CVE-2026-32874 UltraJSON has a Memory Leak parsing large integers allows DoS

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory leak in JSON parsing large outside of the range -2^63, 2^64 - 1 integers. The leaked memory is a copy of the string form of the integer plus a...

CVE-2026-32880

ChurchCRM prior to 7.0.2 is vulnerable to Stored XSS via JSON handling in SystemSettings.php, where unsanitized JSON input for system settings can store a JavaScript payload that executes when an admin views settings. Root cause: unescaped JSON input in SystemSettings.php. Impact: cross-site scri...