SUSE CVE-2026-48552

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbitrary JavaScript in the victim's browse...

New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

Vulnerability Information - Product: new-api - Affected versions: versions before v1.0.0-rc.7 that serialize User.AccessToken as accesstoken; the issue was confirmed in v0.12.14 - Patched version: v1.0.0-rc.7 - Fixed commit: 0936e2504655a5cbf7bc3c388f6d3e2bb24916d3 - Type: Information Disclosure ...

CVE-2026-53960

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A QAPage JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engi...

CVE-2026-53960

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A QAPage JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engi...

CVE-2026-53960 Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A QAPage JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engi...

EUVD-2026-60238

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A QAPage JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engi...

CVE-2026-53960 Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A QAPage JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engi...

CVE-2026-53960

Discourse leaked hidden first-post excerpts in publicly served QAPage JSON-LD structured data, accessible to unauthenticated visitors and search-engine crawlers. Fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. No exploitation reported. CVSS 5.3 MEDIUM (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:...

JSONPath v10.4.1

see also licenses for dev. deps. JSONPath Plus Analyse, transform, and selectively extract data from JSON documents and JavaScript objects. jsonpath-plus expands on the original specification to add some additional operators and makes explicit some behaviors the original did not spell out. Try th...

Security Bulletin: IBM Operations Analytics - Log Analysis is affected by an Improper Serialization due to Apache Log4j JSON Template Layout

Summary Apache Log4j JSON Template Layout in Apache Solr is used by IBM Operations Analytics - Log Analysis as part of the encoding log events. CVE-2026-34481. Vulnerability Details CVEID:CVE-2026-34481 DESCRIPTION: Apache Log4j's JsonTemplateLayout...

PYSEC-2026-3755

opensslencrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process...

WordPress Invisible Anti-Spam & CAPTCHA plugin <= 5.1 - Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values vulnerability

Authenticated Editor+ SQL Injection via Pattern JSON Keys/Values vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant versions = 5.1...

EUVD-2026-60094

opensslencrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process...

MINI-Q97P-7R8M-562R

Bulletin has no description...

Fastjson 1.2.83 Remote Code Execution

Fastjson versions 1.2.68 through 1.2.83 contain a remote code execution vulnerability that can allow an attacker to cause a vulnerable application to load attacker-controlled Java classes. This proof of concept generates a malicious JAR containing a reverse shell payload, serves the JAR over HTTP...

Unity Linux 20.1070e Security Update: log4j (UTSA-2026-099511)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099511 advisory. Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JS...

Unity Linux 20.1070e Security Update: log4j (UTSA-2026-099531)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099531 advisory. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue...

Unity Linux 20.1070e Security Update: perl-Mojolicious (UTSA-2026-099533)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099533 advisory. Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path decodevalue dispatching ...

PT-2026-73238

Apache Airflow's secrets masker did not mask var.json Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an isinstancestr guard — so a secret stored as a JSON Variable and referenced in a template via var.json was displayed in cleartext to any user with...

PT-2026-76809

Name of the Vulnerable Software and Affected Versions SWE-agent's trajectory inspector version 1.1.0 Description The HTTP server fails to properly sanitize request paths in the '/trajectory/' endpoint, allowing the use of parent-directory '..' references to perform path traversal. The server bind...