CVE-2026-52130

A flaw was found in llama.cpp. This vulnerability, caused by uncontrolled recursion in the common/json-schema-to-grammar.cpp component, allows an attacker to trigger a denial of service. This can lead to the affected system becoming unresponsive or unavailable. Mitigation Restrict or disable API...

CVE-2025-1974_IngressNightmare_PoC

CVE-2025-1974IngressNightmare poc IngressNightmare Script Un script de Python para automatizar el envío de cargas útiles JSON a una lista de IPs mediante curl, capturando respuestas y dividiéndolas en informes XML de éxito y fallo. Características Envía solicitudes HTTPS POST con una carga útil...

CVE-2026-107839

ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the...

CVE-2026-107839 ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the...

CVE-2026-107839

The ageLANServer software, which provides a cross-platform web server and launcher for Age of Empires and Age of Mythology games, is vulnerable to a Remote Denial of Service (DoS) . In versions prior to 1.15.2 , the AoE3 POST /game/cloud/getFileURL handler lacks a request body size limit and fail...

CVE-2026-107839 ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the...

CVE-2026-107833 OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can...

CVE-2026-107833

The OWASP Coraza WAF library (versions 3.0.0 through 3.8.0 ) contains an unbounded recursion vulnerability in the ProcessResponse function located in internal/bodyprocessors/json.go. The root cause is that the ignoreJSONRecursionLimit value of -1 is passed to readJSON, while the recursive guard o...

CVE-2026-107833 OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can...

CVE-2026-107826 OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An...

CVE-2026-107826 OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An...

CVE-2026-107826

The OWASP Coraza WAF library (versions 3.0.0 to 3.8.1 ) is vulnerable to a stack overflow due to how the readJSON function in internal/bodyprocessors/json.go handles argument limits. When the bounded flattening walk reaches the SecArgumentsLimit or byte budget, it may still call gjson.Valid on th...

day01-sessionreaper-lab

Día 1 — Laboratorio Vulnerable estilo SessionReaper Educativo Este es un pequeño laboratorio que simula la idea central reportada para CVE-2025-54236 “SessionReaper”: validación incorrecta de JSON anidado que conduce a rutas de código peligrosas. Esto no es Magento/Adobe Commerce; es una réplica...

OWASP__json-sanitizer_CVE-2020-13973_1-2-0

json-sanitizer Dado contenido similar a JSON, el Sanitizador de JSON lo convierte a JSON válido. Primeros pasos - Contacto Esto puede colocarse en cualquier extremo de un pipeline de datos para ayudar a cumplir el principio de Postel: sé conservador en lo que haces, sé liberal en lo que aceptas d...

BIT-GHOST-2026-104417 Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposin...

Ch4120N-CVE-Pulse

⚡ Ch4120N CVE Pulse Live CVE PoC Aggregator with Smart Search & Threat Intelligence CVE Pulse automatically discovers, scores, and indexes CVE Proof‑of‑Concepts from GitHub. It enriches them with EPSS scores and CISA KEV data, builds daily snapshots & diffs, and serves a fast, searchable static...

CVE-2026-104635

A flaw was found in protobuf. An unauthenticated remote attacker can trigger a Denial of Service DoS by submitting a deeply nested JSON document to an application configured to decode self-referential message types. Because the decoder fails to enforce recursion limits on these structures,...

CVE-2026-104635 Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages

Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3,...

CVE-2026-104635 Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages

Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3,...

EUVD-2026-95562

Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3,...