CVE-2026-13699 Databroker 0.6.1 PublishValue missing data_point panic

In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional datapoint field in PublishValueRequest. When a request contains a valid signalid but omits datapoint, the server directly calls unwrap on request.datapoint,...

MAL-2026-10540 Malicious code in postcss-processor-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0253c4f750443ba47f0ab61347fa85a1659b847190a85757575e904966636da On require, src/index.js loads src/token-loader.js, which reads data/design-tokens.json, XOR-decodes the base64 blobs under encrypted.chunks using a...

PT-2026-57985

Name of the Vulnerable Software and Affected Versions Eclipse KUKSA Databroker version 0.6.1 Description The kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data point field in PublishValueRequest. If a request includes a valid signal id but omits data...

CVE-2026-60114: Improper Limitation of a Pathname to a Restricted Directory

Sustainable Irrigation Platform SIP through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths...

CVE-2026-60119: Missing Authorization

Hi.Events through v1.10.0-beta contains a cross-site scripting vulnerability that allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML and JavaScript by embedding a malicious event title containing the sequence, which is not escaped by JSON.stringify whe...

PT-2026-58004

Name of the Vulnerable Software and Affected Versions Opcenter X versions prior to V2604 Description An issue exists where the application fails to properly validate the algorithm specified in the JSON Web Token JWT header. This flaw allows an unauthenticated remote attacker to forge arbitrary...

PT-2026-58049

Sustainable Irrigation Platform SIP through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths...

PT-2026-60100

Name of the Vulnerable Software and Affected Versions @feathersjs/commons versions prior to 5.0.45 Description The .mergetarget, source utility recursively merges a source object into a target object by iterating through Object.keyssource. If the source object is generated via JSON.parse and...

PT-2026-58045

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Weak authentication in Microsoft Office SharePoint allows an unauthenticated remote attacker to bypass security features over a network. The issue resides in the JWT token...

PT-2026-58808

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.18.0 through 2.18.8 jackson-databind versions 2.21.0 through 2.21.4 jackson-databind versions 2.22.0 through 2.22.0 jackson-databind versions 3.1.0 through 3.1.4 jackson-databind versions 3.2.0 through 3.2.0...

json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS

Circular JSON Schema $ref causes unbounded CPU DoS in jsonrepair Summary SchemaRepairer.resolveschema in jsonrepair follows JSON Schema $ref pointers in an unbounded while loop without any cycle detection. An attacker who can supply a schema containing a self-referencing $ref e.g., via the demo...

adaptiq (0.12.9), aegis-finance-mcp (0.1.1) +185 more potentially affected by unknown CVE via json-repair (>=0.2.0, <=0.59.10)

json-repair PYPI version =0.2.0, =0.0.13, =0.1.1, =0.5.0, =0.4.7, =0.0.6, =1.1.0a20250502, =1.2.0rc5, =0.3.16, =0.3.17 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-JSONREPAIR-17971505...

Infinite loop

Overview json-repair is an A package to repair broken json strings Affected versions of this package are vulnerable to Infinite loop via the resolveschema function. An attacker can cause the application to enter an infinite loop and exhaust CPU resources by submitting a specially crafted JSON...

GHSA-XF7X-X43H-RPQH json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS

Circular JSON Schema $ref causes unbounded CPU DoS in jsonrepair Summary SchemaRepairer.resolveschema in jsonrepair follows JSON Schema $ref pointers in an unbounded while loop without any cycle detection. An attacker who can supply a schema containing a self-referencing $ref e.g., via the demo...

adaptiq (0.12.9), aegis-finance-mcp (0.1.1) +185 more potentially affected by unknown CVE via json-repair (>=0.2.0, <=0.59.10)

json-repair PYPI version =0.2.0, =0.0.13, =0.1.1, =0.5.0, =0.4.7, =0.0.6, =1.1.0a20250502, =1.2.0rc5, =0.3.16, =0.3.17 and more Source cves: unknown CVE Source advisory: OSV:GHSA-XF7X-X43H-RPQH...

adaptiq (0.12.9), aegis-finance-mcp (0.1.1) +185 more potentially affected by unknown CVE via json-repair (>=0.2.0, <=0.59.10)

json-repair PYPI version =0.2.0, =0.0.13, =0.1.1, =0.5.0, =0.4.7, =0.0.6, =1.1.0a20250502, =1.2.0rc5, =0.3.16, =0.3.17 and more Source cves: unknown CVE Source advisory: GHSA-XF7X-X43H-RPQH...

Malicious code in type-astr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89817054cec44ec8ba09dd26af025483096055c0a931172bd4a63910dceb87fc The package presents itself as a pino-compatible logger exports a middleware aliased as pino, ships pino-like files such as proto.js, redaction.js,...

MAL-2026-10512 Malicious code in type-unique (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b576b19c56055dbc3638b361d0071c669108b9a6f8756828cadee4214d57bb13 [email protected] presents itself as the pino logger matching README, keywords, and package shape but on require its index.js spawns a detached node...

CVE-2026-15680

Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit th...

CVE-2026-15680

Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit th...