58523 matches found
CVE-2026-69098
kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...
python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens
A flaw was found in PyJWT, a Python library for JSON Web Token JWT implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys JWK in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the...
python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens
A flaw was found in PyJWT, a Python library for JSON Web Token JWT implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys JWK in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the...
Important: Red Hat Security Advisory: Satellite 6.16.12 Async Update
An update is now available for Red Hat Satellite 6.16 for RHEL 8 and RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
Important: Red Hat Security Advisory: Satellite 6.17.10 Async Update
A new release is now available for Red Hat Satellite 6.17 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens
A flaw was found in PyJWT, a Python library for JSON Web Token JWT implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys JWK in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the...
Malicious code in @servicetitan/json-render-react (npm)
npm/@servicetitan/json-render-react is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11881 Malicious code in @servicetitan/json-render-react (npm)
npm/@servicetitan/json-render-react is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
UBUNTU-CVE-2026-68494
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...
CVE-2026-18401
The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...
CVE-2026-69098
kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...
CLSA-2026-1784596282 TuxCare security update for ajv (1 CVE)
TuxCare rebuilt ajv to address 1 CVE. Fixed in 6.10.0-tuxcare.1...
CLSA-2026-1781052738 TuxCare security update for json-schema (1 CVE)
TuxCare rebuilt json-schema to address 1 CVE. Fixed in 0.2.3-tuxcare.1...
CLSA-2026-1779151625 TuxCare security update for ajv (2 CVEs)
TuxCare rebuilt ajv to address 2 CVEs. Fixed in 6.4.0-tuxcare.1...
CLSA-2026-1776818196 TuxCare security update for ajv (1 CVE)
TuxCare rebuilt ajv to address 1 CVE. Fixed in 5.5.2-tuxcare.4...
CLSA-2026-1774916723 TuxCare security update for ajv (1 CVE)
TuxCare rebuilt ajv to address 1 CVE. Fixed in 8.6.2-tuxcare.1...
CLSA-2026-1774398090 TuxCare security update for com.cedarsoftware:json-io (1 CVE)
TuxCare rebuilt com.cedarsoftware:json-io to address 1 CVE. Fixed in 2.9.4-tuxcare.1...
CLSA-2026-1774657370 TuxCare security update for jsonwebtoken (2 CVEs)
TuxCare rebuilt jsonwebtoken to address 2 CVEs. Fixed in 0.4.0-tuxcare.1...