Ollama - Remote Code Execution

Ollama before 0.1.34 does not validate the format of the digest sha256 with 64 hex digits when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring. id: CVE-2024-37032 info: name: Ollama ...

CLEANSTART-2026-PZ72315 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

CLEANSTART-2026-IX04206 Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS)

Security vulnerability affects the apache-hive package. Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS...

CLEANSTART-2026-VO44592 Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS)

Security vulnerability affects the apache-hive package. Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS...

CLEANSTART-2026-XJ20290 undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON

CVE-2026-84961 affects multiple packages. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. See references for individual vulnerability details...

CLEANSTART-2026-QQ14312 jackson-databind binds a JSON string to a javax

CVE-2026-68497 affects multiple packages. jackson-databind binds a JSON string to a javax. See references for individual vulnerability details...

PT-2026-107999

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset key...

PT-2026-108141

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description An incorrect calculation in Decimal128 string parsing allows the driver to accept certain over-precision inputs containing leading zeros instead of rejecting them. This results in th...

PT-2026-108015

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures...

PT-2026-107809

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit form function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...

RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

Summary com.rabbitmq.tools.json.JSONReader.read never returns when its input ends inside a quoted string or a // line comment. Both scanners walk the input with StringCharacterIterator.next but only compare against a delimiter, so once the iterator reaches CharacterIterator.DONE ￿ they loop...

EUVD-2026-93773

RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS...

GHSA-P944-4XH2-X776 Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Summary docling accepts serialized DoclingDocument JSON as an input format InputFormat.JSONDOCLING, enabled by default. A crafted JSON file can set a picture's image uri to a local file path. When the converted document is exported with embedded images ImageRefMode.EMBEDDED, the CLI default for...

GHSA-PJ7X-6WPF-PGVP Payload: SQL injection in SQLite/Postgres

Impact An attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload's SQLite and Postgres. You are affected if: - You use @payloadcms/db-sqlite or @payloadcms/db-d1-sqlite. -...

EUVD-2026-93500

Payload: SQL injection in SQLite/Postgres...

GHSA-M382-6JW4-FMP6 Ghost: Path Traversal via Locale Setting

Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. Vulnerable versions This vulnerability is present in Ghost from v1.20.0 up to...

EUVD-2026-92766

Ghost: Path Traversal via Locale Setting...

Ghost: Path Traversal via Locale Setting

Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. Vulnerable versions This vulnerability is present in Ghost from v1.20.0 up to...

Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in Apache Log4j

Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in Apache Log4j. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during...

Security Bulletin: IBM SPSS Modeler is affected by an Apache Log4j logging vulnerability that may produce malformed JSON log output

Summary IBM SPSS Modeler is affected by an Apache Log4j logging vulnerability that may produce malformed JSON log output. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during...