Mongoose - NoSQL Injection

NoSQL injection vulnerability in Mongoose 8.9.5 affecting the populate function's match option. This vulnerability exists due to an incomplete fix for CVE-2024-53900. While direct $where injection is blocked, attackers can bypass this protection by nesting $where operators within logical operator...

Januscape

Januscape: Guest-to-Host Escape in KVM/x86 Abstract This document describes the Januscape CVE-2026-53359 vulnerability discovered and reported by Hyunwoo Kim @v4bel. It is a KVM escape vulnerability that lets a guest escape to the host in a KVM/x86 environment. To the best of public knowledge, th...

Security Bulletin: A Vulnerability in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU plus deferred CVE-2026-16440

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server and IBM WebSphere Application Server Liberty. The CVEs listed in this document might affect some configurations of IBM WebSphere Application Server traditiona...

CVE-2026-122053

The Symfony Serializer component ObjectNormalizer treats any attribute name containing . and, from Symfony 6.4, as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their Ignore metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9...

EUVD-2026-118360

The Symfony Serializer component ObjectNormalizer treats any attribute name containing . and, from Symfony 6.4, as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their Ignore metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9...

CVE-2026-117624

A flaw was found in Jenkins. The application fails to consistently enforce restrictions against deserializing certain object types as nested values when those types are designated only for top-level configuration files. An attacker can exploit this flaw by submitting crafted configuration data to...

CVE-2026-110974

A flaw was found in android-json. The parser lacks depth limits when processing nested structures such as arrays and objects. A remote attacker could exploit this vulnerability by submitting a crafted, deeply nested JSON payload to an application using the library, triggering uncontrolled recursi...

CVE-2026-77620

A flaw was found in Vector's logstash source. An unauthenticated remote attacker can send specially crafted nested compressed frames. This can cause recursive decoding, leading to the exhaustion of the worker thread stack and amplification of decompressed input. Consequently, the process may...

CVE-2026-109449

A flaw was found in symfony/expression-language. The parser does not enforce a limit on the depth of nested expressions when constructing syntax trees. A remote attacker can exploit this flaw by submitting a crafted expression with deeply nested structures, causing the application process to cras...

CVE-2026-95155

A flaw was found in jackson-mapper-asl. This vulnerability allows a remote attacker to cause a Denial of Service DoS by submitting deeply nested JSON input to an application that deserializes untrusted data using the ObjectMapper component. Processing the excessively nested structure exhausts...

CVE-2026-121007

A flaw was found in SQL::Abstract. When processing nested statements placed in identifier positions, the library inserts clause values directly into raw database queries rather than parameterizing them as bound values. If an application incorporates untrusted input into these nested queries, an...

CVE-2026-121007

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as -select = ... in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These...

SUSE CVE-2026-121438

Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...

CVE-2026-121007 SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as -select = ... in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These...

CVE-2026-121007

The SQL::Abstract Perl module (versions 1.90_01 to 2.000001_04 ) is vulnerable to SQL injection . The root cause is that nested statements (e.g., { -select => ... }) placed in positions where plain scalars are treated as identifiers—such as the select list , ORDER BY , GROUP BY , RETURNING , a...

EUVD-2026-116927

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as -select = ... in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These...

Linux Distros Unpatched Vulnerability : CVE-2026-121438

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying...

CVE-2026-121007: SQL Injection

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as -select = ... in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These...

PT-2026-136979

SQL::Abstract versions from 1.90 01 before 2.000001 04 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as -select = ... in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. The...

CVE-2026-121438

A flaw was found in mistune. A remote attacker could cause a Denial of Service DoS by submitting specially crafted Markdown input containing deeply nested brackets. Because the link parser performs repetitive scans when evaluating these nested brackets, processing the crafted input consumes...