MSC-2026-6399

Malicious PyPI package that masquerades as a colorful console logger with emoji icons. On import it runs an infostealer: on Linux it appends an attacker-controlled SSH key to the user's authorizedkeys, then on all platforms it recursively harvests .env files and small .json files from every user...

KAVACHx

Intelligent Exploit & Patch Management Platform A full-stack...

CVE-2019-25449

OrientDB 3.0.17 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted JSON payloads to the document endpoint. Attackers can send POST requests to /document/demodb/-1:-1 with script tags in the name parameter to execute...

CVE-2026-27487

OpenClaw is a personal AI assistant. In versions 2026.2.13 and below, when using macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via security add-generic-password -w .... Because OAuth tokens are user-controlled data,...

Deserialization of Untrusted Data

Overview zumba/json-serializer is a Serialize PHP variables, including objects, in JSON format. Support to unserialize it too. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonSerializer::unserialize function. An attacker can execute arbitrary code...

CVE-2026-27206

Zumba Json Serializer is a library to serialize PHP variables in JSON format. In versions 3.2.2 and below, the library allows deserialization of PHP objects from JSON using a special @type field. The deserializer instantiates any class specified in the @type field without restriction. When...

CVE-2026-27206 Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()

Zumba Json Serializer is a library to serialize PHP variables in JSON format. In versions 3.2.2 and below, the library allows deserialization of PHP objects from JSON using a special @type field. The deserializer instantiates any class specified in the @type field without restriction. When...

CVE-2026-27206

Zumba Json Serializer is a library to serialize PHP variables in JSON format. In versions 3.2.2 and below, the library allows deserialization of PHP objects from JSON using a special @type field. The deserializer instantiates any class specified in the @type field without restriction. When...

CVE-2026-27206

The CVE concerns Zumba Json Serializer for PHP. Versions 3.2.2 and earlier allow deserialization of PHP objects from JSON via an @type field, which can instantiate any class specified without restrictions. If attacker-controlled JSON reaches JsonSerializer::unserialize() and the app contains clas...

CVE-2026-27206

Zumba Json Serializer is a library to serialize PHP variables in JSON format. In versions 3.2.2 and below, the library allows deserialization of PHP objects from JSON using a special @type field. The deserializer instantiates any class specified in the @type field without restriction. When...

CVE-2026-27206 Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()

Zumba Json Serializer is a library to serialize PHP variables in JSON format. In versions 3.2.2 and below, the library allows deserialization of PHP objects from JSON using a special @type field. The deserializer instantiates any class specified in the @type field without restriction. When...

CVE-2026-27206 Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()

Zumba Json Serializer is a library to serialize PHP variables in JSON format. In versions 3.2.2 and below, the library allows deserialization of PHP objects from JSON using a special @type field. The deserializer instantiates any class specified in the @type field without restriction. When...

SQL Injection

egroupware/egroupware is vulnerable to SQL Injection. The vulnerability is due to a PHP type juggling issue where JSON decoding converts numeric strings into integers, bypassing the isint security check used by the application, and allows authenticated attackers to inject arbitrary SQL commands...

CVE-2026-27189

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Versions 1.1.2-alpha and below, use non-atomic and insufficiently synchronized local JSON persistence flows, potentially causing concurrent operations to lose updates or corrupt local state...

CVE-2026-27189: Time-of-check Time-of-use (TOCTOU) Race Condition

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Versions 1.1.2-alpha and below, use non-atomic and insufficiently synchronized local JSON persistence flows, potentially causing concurrent operations to lose updates or corrupt local state...

JSON Serializer for PHP code issue vulnerabilities

Json Serializer for PHP is an open-source JSON serialization tool developed by Zumba. Versions of Json Serializer for PHP prior to 3.2.2 had code vulnerabilities. These vulnerabilities stemmed from the ability to deserialize PHP objects using the @type field, which could lead to PHP object...

CVE-2026-27206: Deserialization of Untrusted Data

Zumba Json Serializer is a library to serialize PHP variables in JSON format. In versions 3.2.2 and below, the library allows deserialization of PHP objects from JSON using a special @type field. The deserializer instantiates any class specified in the @type field without restriction. When...

CVE-2026-27210: Improper Neutralization of Input During Web Page Generation

Pannellum is a lightweight, free, and open source panorama viewer for the web. In versions 3.5.0 through 2.5.6, the hot spot attributes configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks. This affects websites hostin...

CVE-2019-25449

CVE-2019-25449 affects OrientDB 3.0.17 with a reflected cross-site scripting flaw. The issue allows attackers to submit crafted JSON payloads to the document endpoint, performing a POST to /document/demodb/-1:-1 and injecting script tags in the name parameter to execute arbitrary JavaScript in us...

GHSA-QV8J-HGPC-VRQ8 Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)

Stored Cross-Site Scripting XSS in the genai/evalsvisualization component of Google Cloud Vertex AI SDK google-cloud-aiplatform versions from 1.98.0 up to but not including 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment...