CVE-2026-89212

A flaw resulting in XML external entity XXE was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 including older unsupported versions of Akana and has been...

CVE-2026-89212 XML External Entity in Akana API Platform

A flaw resulting in XML external entity XXE was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 including older unsupported versions of Akana and has been...

EUVD-2026-76103

A flaw resulting in XML external entity XXE was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 including older unsupported versions of Akana and has been...

CVE-2026-89212

Akana API Platform contains an XML External Entity (XXE) vulnerability in its XML-to-JSON processing component, where external entity references were improperly restricted. This allows a remote, unauthenticated attacker to exploit the flaw over the network with low complexity, resulting in high c...

CVE-2026-89212: Improper Restriction of XML External Entity Reference

A flaw resulting in XML external entity XXE was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 including older unsupported versions of Akana and has been...

CVE-2024-58381

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties,...

CVE-2024-58381 PocketMine-MP before 5.11.1 Denial of Service via LoginPacket

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties,...

CVE-2024-58381

PocketMine-MP before 5.11.1 is vulnerable to a denial of service in its LoginPacket JSON processing . A remote attacker can crash the server by sending malformed JSON data, exploiting improper object initialization from scalar JSON types that triggers unset required properties. The vulnerability ...

CVE-2024-58381 PocketMine-MP before 5.11.1 Denial of Service via LoginPacket

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties,...

The vulnerability of the JSON processing library and stream-json, related to algorithmic complexity, allows attackers to cause service failures.

The vulnerability of the JSON processing library and stream-json is related to algorithmic complexity. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the JSON data processing tool JQ, related to buffer overflows, allows attackers to trigger a denial-of-service attack.

The vulnerability of the JSON data processing tool JQ is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the JSON data processing tool JQ, related to uncontrolled recursion, allows a hacker to cause a service failure.

The vulnerability of the JSON data processing tool JQ is related to uncontrolled recursion. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-66920 Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing a...

The vulnerability of the jv_contains() function in the jq JSON processing tool allows a hacker to cause a service failure.

The vulnerability of the jvcontains function in the jq JSON processing tool is related to an uncontrolled recursion. Exploiting this vulnerability could allow an attacker to cause a service failure...

EUVD-2026-38591

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual, per-property @JsonIgnoreProperties exclusions are applied by handleByNameInclusion, producing a...

CVE-2026-9516

A flaw was found in Cpanel::JSON::XS, a Perl module used for processing JSON data. This vulnerability allows a remote attacker to cause a denial of service DoS by providing specially crafted input that begins with a UTF-8 Byte Order Mark BOM. When a decode filter callback encounters an error with...

jq: jq: Denial of Service via crafted JSON object causing hash collisions

A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq's hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause has...

ALPINE-CVE-2026-40612

jq is a command-line JSON processor. In 1.8.1 and earlier, jvcontains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure built programmatically with reduce, since the JSON parser caps at depth 10000, the C stack is exhausted...

BIT-THRIFT-2026-41607 Apache Thrift: C++ JSON OOB read

Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue...

jq: jq: Denial of Service via crafted JSON object causing hash collisions

A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq's hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause has...