stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

Summary The JSONC parser stream-json/jsonc/parser.js and verifier stream-json/jsonc/verifier.js scan a comment for its terminator starting from the comment's opening / on every input chunk. When a comment doesn't finish inside the current buffer, the scanner returns the comment's start offset and...

GHSA-HQR4-QQ8F-HG3X stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

Summary The JSONC parser stream-json/jsonc/parser.js and verifier stream-json/jsonc/verifier.js scan a comment for its terminator starting from the comment's opening / on every input chunk. When a comment doesn't finish inside the current buffer, the scanner returns the comment's start offset and...

EUVD-2026-91056

stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk...

stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

Summary A prototype-pollution vulnerability in stream-json lets attacker-controlled JSON replace a parsed object's prototype. Details The streaming JSON parser StreamValues/StreamObject/jsonc variants writes keys via plain assignment, so a proto key replaces the parsed object's prototype with...

NPM: stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

NPM: stream-json has a prototype pollution issue: Assembler writes this.currentthis.key on plain objects vulnerability discovered by ? in WordPress Npm stream-json versions 3.6.0...

EUVD-2026-91057

stream-json has a prototype pollution issue: Assembler writes this.currentthis.key on plain objects...

authowl (>=0.3.0, <=0.3.12), quicktype (>=26.0.0-pre1, <=26.0.0) +1 more potentially affected by CVE-2026-104183 via stream-json (3.5.0)

stream-json NPM version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on stream-json and may be impacted: - authowl =0.3.0, =26.0.0-pre1, =0.1.0, =0.1.1 Source cves: CVE-2026-104183 Source advisory: OSV:GHSA-MJW6-4JJ6-33HC...

GHSA-MJW6-4JJ6-33HC stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

Summary A prototype-pollution vulnerability in stream-json lets attacker-controlled JSON replace a parsed object's prototype. Details The streaming JSON parser StreamValues/StreamObject/jsonc variants writes keys via plain assignment, so a proto key replaces the parsed object's prototype with...

CVE-2026-47668

CVE-2026-47668 — Exécution de code à distance DbGate RCE non authentifié dans le DbGate JSON Script Runner dbgate-serve ≤ 7.1.8. Outil d'évaluation : CVE-2026-47668.py — tests autorisés uniquement. | ---|--- CVE| CVE-2026-47668 Severité| Critique Produit| DbGate / dbgate-serve Affecté| ≤ 7.1.8...

CVE-2026-105748

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSONDOCLING backend in docling/backend/json/doclingjsonbackend.py validates serialized DoclingDocument input without rejecting...

CVE-2026-9277

CVE-2026-9277 - Exploit d'injection de commandes Shell-Quote Un script d'exploit Proof of Concept PoC spécialisé conçu pour vérifier et démontrer CVE-2026-9277 — une vulnérabilité structurelle d'injection de commandes trouvée dans les versions obsolètes de la bibliothèque shell-quote = 1.8.3. Le...

CVE-2026-105676

Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is...

CVE-2026-54350-Budibase-NoSQL-Injection

CVE-2026-54350 — Injection d'opérateur NoSQL non authentifiée dans Budibase Injection d'opérateur JSON/NoSQL non authentifiée dans Budibase. Tout visiteur anonyme d'une application Budibase publiée qui expose une requête PUBLIQUE soutenue par une source de données documentaire MongoDB, CouchDB,...

fastjson-RCE

fastjson-v1.2.47-RCE — Reproduction de la vulnérabilité fastjson-1.2.47 Téléchargement des ressources: 下载 http://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.47/ 文档 https://github.com/alibaba/fastjson/wiki/%E5%B8%B8%E8%A7%81%E9%97%AE%E9%A2%98 源码...

CVE-2026-105676 Ghost: Path Traversal via Locale Setting

Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is...

CVE-2026-105676

Ghost, a Node.js content management system , is vulnerable to a path traversal flaw in how it loads theme translation files. Affected versions range from 1.20.0 until 6.64.0 . An authenticated Administrator can exploit this vulnerability to read JSON files outside of the active theme's directory,...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON JavaScript Object Notation data to a service that reads and processes it. This can lead to a Denial of Service Do...

CVE-2018-0114

CVE-2018-0114 script python2.7 pour la génération de JWT CVE-2018-0114 Une vulnérabilité dans la bibliothèque open source Cisco node-jose avant la version 0.11.0 pourrait permettre à un attaquant distant non authentifié de signer à nouveau des jetons en utilisant une clé intégrée dans le jeton. L...

CVE-2026-102295

A cross-site scripting (XSS) vulnerability exists in Quay within the OAuth callback handler (specifically via the oauth local callback format=json parameter). The root cause is improper input sanitization , which allows a remote attacker to execute arbitrary JavaScript in a user's browser by tric...