PT-2026-105571

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS in github.com/tomwright/dasel...

CVE-2026-104182: Inefficient Algorithmic Complexity

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...

CVE-2026-104183: Improperly Controlled Modification of Object Prototype Attributes

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...

PT-2026-105861

Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output...

PT-2026-104010

Name of the Vulnerable Software and Affected Versions stream-json versions prior to 3.6.0 Description The JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash when a block or line comment spans an inpu...

PT-2026-103824

Name of the Vulnerable Software and Affected Versions Ghost versions 0.5.3 through 6.49.9 Description Insufficient sanitization of data within the JSON-LD HTML tag emitted by the ghost head helper allows an authenticated user with limited privileges to inject unescaped content. This content is...

PT-2026-104011

Name of the Vulnerable Software and Affected Versions stream-json versions prior to 3.6.0 Description The Assembler component materializes object properties using plain assignment. When an input key is named proto , it invokes the inherited setter, leading to the replacement of the parsed object...

PT-2026-105158

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name and the exchanges and bindings endpoints accepts a node JSON field. The value goes through rabbitnodes:make →...

PT-2026-105847

Summary When OAuth tokens are saved, MCP Atlassian always writes a plaintext fallback copy under /.mcp-atlassian/oauth-.json. The fallback file is created with the process default umask rather than restrictive permissions. In this environment the file was created as mode 0664, exposing access and...

Rocky Linux 9 [CIQ] Security Update: iperf3 / iperf3-debuginfo / iperf3-debugsource (crlsa-2025_0161)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20250161 advisory. iperf: Denial of Service in iperf Due to Improper JSON Handling CVE-2024-53580 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: iperf3 / iperf3-debuginfo / iperf3-debugsource (crlsa-2025_0168)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20250168 advisory. iperf: Denial of Service in iperf Due to Improper JSON Handling CVE-2024-53580 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: python3.11-PyMySQL / python3.11-PyMySQL+rsa (crlsa-2024_9194)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20249194 advisory. python-pymysql: SQL injection if used with untrusted JSON input CVE-2024-36039 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: python3.12-PyMySQL / python3.12-PyMySQL+rsa (crlsa-2024_9193)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20249193 advisory. python-pymysql: SQL injection if used with untrusted JSON input CVE-2024-36039 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: perl-JSON-XS / perl-JSON-XS-debuginfo / perl-JSON-XS-debugsource (crlsa-2025_17162)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202517162 advisory. JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON CVE-2025-40928 Tenable has extracted the preceding description block directly from th...

Rocky Linux 9 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc (crlsa-2026_26206)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202626206 advisory. python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens CVE-2026-48526 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2026_54243)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654243 advisory. grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33377 grafana: Grafana: Denial of Service due to excessive memory allocation via...

Rocky Linux 9.4 [CIQ] Security Update: rubygem-json / rubygem-json-debuginfo (ciqsa-2026_1290)

The Rocky Linux 9.4 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261290 advisory. This advisory aggregates security fixes for the ruby SRPM in CIQ LTS 9.4. It addresses 1 CVE: CVE-2024-49761. Tenable has extracted the preceding description bloc...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc (crlsa-2026_19173)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619173 advisory. github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption JWE object CVE-2026-34986 Tenable has...

AlmaLinux 9.2 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc (ALMALINUX9.2:CLSA-2026:1777477457)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777477457 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, a crafted image...

AlmaLinux 9.2 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778297730)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778297730 advisory. - In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malforme...