com.agorapulse:gru-micronaut (1.4.0), com.bertramlabs.plugins:asset-pipeline-grails (>=4.5.0, <=4.5.2) +184 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=3.9.0, <=3.10.4)

io.micronaut:micronaut-json-core MAVEN version =3.9.0, =4.5.0, =1.3.6, =1.30.0, =2.14.0, =2.12.0, =1.13.0, =0.1.0, =6.0.9, =6.0.10 - io.github.matrei:grails-inertia-plugin 2.0.0 and more Source cves: CVE-2026-33013 Source advisory: GHSA-43W5-MMXV-CPVH...

com.agorapulse:micronaut-amazon-awssdk-dynamodb-loader (>=3.4.3, <=4.2.0), com.agorapulse:micronaut-amazon-awssdk-kinesis (>=3.4.3, <=4.2.0) +476 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=4.0.0-m1, <=4.10.15)

io.micronaut:micronaut-json-core MAVEN version =4.0.0-m1, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.5.1 and more Source cves: CVE-2026-33013 Source advisory: SNYK:JAVA-IOMICRONAUT-15682607...

com.agorapulse:micronaut-amazon-awssdk-dynamodb-loader (>=3.4.3, <=4.2.0), com.agorapulse:micronaut-amazon-awssdk-kinesis (>=3.4.3, <=4.2.0) +476 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=4.0.0-m1, <=4.10.15)

io.micronaut:micronaut-json-core MAVEN version =4.0.0-m1, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.5.1 and more Source cves: CVE-2026-33013 Source advisory: GHSA-43W5-MMXV-CPVH...

com.agorapulse:micronaut-amazon-awssdk-cloudwatch (>=1.6.1-micronaut-3.0, <=2.2.2-micronaut-3.0), com.agorapulse:micronaut-amazon-awssdk-cloudwatchlogs (>=2.0.8-micronaut-3.0, <=2.2.2-micronaut-3.0) +448 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=3.1.0, <=3.8.12)

io.micronaut:micronaut-json-core MAVEN version =3.1.0, =1.6.1-micronaut-3.0, =2.0.8-micronaut-3.0, =1.6.1-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.2-micronaut-3.0, =2.0.0-micronaut-3.0, =1.7.2-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.1-micronaut-3.0,...

io.micronaut.aws:micronaut-aws-alexa (5.0.0-m1), io.micronaut.aws:micronaut-aws-alexa-httpserver (5.0.0-m1) +137 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=5.0.0-m1, <=5.0.0-m13)

io.micronaut:micronaut-json-core MAVEN version =5.0.0-m1, =5.0.0-m13 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-json-core and may be impacted: - io.micronaut.aws:micronaut-aws-alexa 5.0.0-m1 -...

com.agorapulse:gru-micronaut (1.4.0), com.bertramlabs.plugins:asset-pipeline-grails (>=4.5.0, <=4.5.2) +184 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=3.9.0, <=3.10.4)

io.micronaut:micronaut-json-core MAVEN version =3.9.0, =4.5.0, =1.3.6, =1.30.0, =2.14.0, =2.12.0, =1.13.0, =0.1.0, =6.0.9, =6.0.10 - io.github.matrei:grails-inertia-plugin 2.0.0 and more Source cves: CVE-2026-33013 Source advisory: OSV:GHSA-43W5-MMXV-CPVH...

com.agorapulse:gru-micronaut (1.4.0), com.agorapulse:micronaut-amazon-awssdk-cloudwatch (>=1.6.1-micronaut-3.0, <=2.2.2-micronaut-3.0) +508 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=3.1.0, <=3.10.4)

io.micronaut:micronaut-json-core MAVEN version =3.1.0, =1.6.1-micronaut-3.0, =2.0.8-micronaut-3.0, =1.6.1-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.2-micronaut-3.0, =2.0.0-micronaut-3.0, =1.7.2-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.1-micronaut-3.0,...

com.agorapulse:micronaut-amazon-awssdk-dynamodb-loader (>=3.4.3, <=4.2.0), com.agorapulse:micronaut-amazon-awssdk-kinesis (>=3.4.3, <=4.2.0) +476 more potentially affected by CVE-2026-33013 via io.micronaut:micronaut-json-core (>=4.0.0-m1, <=4.10.15)

io.micronaut:micronaut-json-core MAVEN version =4.0.0-m1, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.4.3, =3.5.1 and more Source cves: CVE-2026-33013 Source advisory: OSV:GHSA-43W5-MMXV-CPVH...

SUSE CVE-2026-27962

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any...

SUSE CVE-2026-28490

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption JWE RSA15 key management algorithm. Authlib registe...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the MariaDBFilterExpressionConverter, which allows attackers to bypass metadata-based access controls and execute SQL statements with malicious JSONVALUE input. Remediation Upgrade...

EulerOS 2.0 SP11 : haproxy (EulerOS-SA-2026-1580)

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON...

Improper Verification of Cryptographic Signature

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the JsonWebSignature.preparealgorithmkey method in authlib/jose/rfc7515/jws.py. An attacker can bypass authenticatio...

GO-2026-4514 Denial of service in github.com/buger/jsonparser

The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack...

Malicious code in chacha-lite-encrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 705b86da323a21b157504bf4833b60c8aa90a57d6db5111716afe31c114b6c1d During import, package decrypts and runs a malicious executable. The executable is hidden in an encoded and xored form in the JSON resource file. This is a...

MAL-2026-1482 Malicious code in chacha-lite-encrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 705b86da323a21b157504bf4833b60c8aa90a57d6db5111716afe31c114b6c1d During import, package decrypts and runs a malicious executable. The executable is hidden in an encoded and xored form in the JSON resource file. This is a...

CVE-2026-28490

A flaw was found in Authlib, a Python library for building OAuth and OpenID Connect servers. This cryptographic padding oracle vulnerability, affecting the JSON Web Encryption JWE RSA15 key management algorithm, could allow a remote attacker to decrypt sensitive information. The vulnerability...

CVE-2026-27962

A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK JSON Web Key Header Injection, affects how Authlib verifies digital signatures in JWS JSON Web Signature tokens. An attacker can exploit this by creati...

CVE-2026-27962

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any...

PYSEC-2026-2116

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption JWE RSA15 key management algorithm. Authlib registe...