53584 matches found
CVE-2026-51296
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51298
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
EUVD-2026-49352
sqlite 3.41 has a use-after-free vulnerability in the JSON parsing logic. Remote adversaries can craft malicious JSON payload to trigger memory free followed by illegal memory access, which may lead to arbitrary code execution, sensitive information leakage and service denial...
CVE-2026-51297
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51296
SQLite 3.41 has a use-after-free vulnerability in the JSON module’s jsonRemoveFunc. The parsed JSON object is freed at line 3555 while jsonLookupStep is called on the released pointer at line 3575, enabling remote attackers to crash the service and potentially leak heap memory information. Affect...
CVE-2026-51297
This CVE entry is rejected/not used and does not represent an active vulnerability.
Linux Distros Unpatched Vulnerability : CVE-2026-17501
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the...
CVE-2026-60718
Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON. Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged...
CVE-2026-60194
Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON Duality. Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high...
CVE-2026-61109
Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily...
sqlite: sqlite: Arbitrary code execution via use-after-free in JSON parsing
A flaw was found in sqlite. This use-after-free vulnerability in the JSON parsing logic allows remote attackers to craft malicious JSON payloads. This can trigger memory deallocation followed by illegal memory access, potentially leading to arbitrary code execution, sensitive information leakage,...
PT-2026-64981
Name of the Vulnerable Software and Affected Versions sqlite version 3.41 Description A use-after-free issue exists in the JSON parsing logic. This occurs when a remote adversary provides a specially crafted JSON payload that triggers a memory free followed by illegal memory access. This conditio...
SQL Injection
Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to SQL Injection in the json field enrichment process. An attacker can access unauthorized data, execute arbitrary JavaScript on the database server, perform cross-collection queries, or modify and...
EUVD-2026-42625
Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout...
GHSA-855V-HQ7W-JMJW Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
Summary With Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perfor...
K000162435: Spring Data REST vulnerability CVE-2026-41728
Security Advisory Description Spring Data REST's JSON Patch application/json-patch+json implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16;...
Access of Resource Using Incompatible Type ('Type Confusion')
Overview seroval is a Stringify JS values Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' in the fromJSON process. An attacker can achieve unintended server-side invocation and potentially execute arbitrary code by supplying speciall...
CVE-2026-65709 sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API
sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke...