GHSA-XF85-363P-868W vulnerabilities

Vulnerabilities for packages: eksctl, maru, kyverno, conftest, teleport, chartmuseum, gogatekeeper, consul-k8s, xeol, kargo, k9s, kubescape, tigera-operator, tw, helm-set-status, k8ssandra-client, trivy-operator, argocd-image-updater, opentofu, ratify, helm-mapkubeapis, kube-arangodb,...

PT-2026-54936

Name of the Vulnerable Software and Affected Versions Eclipse Parsson versions prior to 1.1.8 Description The JSON parser does not enforce a default maximum on the number of characters consumed when parsing a single JSON document. This allows an attacker to provide specially crafted JSON document...

qs: qs: Denial of Service via improper input validation in array parsing

A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation e.g., a=value. This bypasses the arrayLimit option, which is designed to limit the size of...

CVE-2026-53426 Atom-table exhaustion denial-of-service via JSON parse_document in MDEx

Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allows Excessive Allocation. MDEx.parsedocument/2 accepts a :json, json source. In lib/mdex.ex, the private jsontonode/1 function passes the attacker-controlled nodetype value to Module.concat/1, which calls...

PYSEC-2026-319 Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

Summary The safeevalexpression function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes giframe, fback, fbuiltins do NOT start with underscore, enabling a complete sandbox escape to achieve...

Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC

ImpactWhen verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs LDP-VCs, the result of verifying the presentation document.proof was not factored into the final verified value true/false on the presentation record. Below is an example result from verifying a JSON-LD...

PT-2026-53575

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape dict...

xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.

...

CVE-2026-39395 vulnerabilities

Vulnerabilities for packages: trivy, cloudbeat-fips, trivy-operator, chainctl-fips, policy-controller-fips, zot, trivy-fips, kyverno-notation-aws-fips, slsa-verifier, ko-fips, policy-controller, aactl, kyverno, chainctl, ratify-fips, commercial-kyverno, trivy-operator-fips,...

GHSA-W6C6-C85G-MMV6 vulnerabilities

Vulnerabilities for packages: trivy, cloudbeat-fips, trivy-operator, chainctl-fips, policy-controller-fips, zot, trivy-fips, kyverno-notation-aws-fips, slsa-verifier, ko-fips, policy-controller, aactl, kyverno, chainctl, ratify-fips, commercial-kyverno, trivy-operator-fips,...

RLSA-2023:6976 Moderate: libfastjson security update

The libfastjson library provides essential JavaScript Object Notation JSON handling functions. The library enables users to construct JSON objects in C, output them as JSON-formatted strings, and convert JSON-formatted strings back to the C representation of JSON objects. Security Fixes: json-c,...

CVE-2026-54350

Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection and, where the builder has published a PUBLIC write...

CVE-2026-48702 vulnerabilities

Vulnerabilities for packages: spire-server-fips, gitsign, cloudbeat-fips, trivy-operator, tkn, chainctl-fips, zarf-fips, falcoctl, neuvector-sigstore-interface, policy-controller-fips, tkn-fips, kyverno-notation-aws-fips, slsa-verifier, falcoctl-fips, ko-fips, tbot, policy-controller,...

GHSA-47Q9-M4WW-924M vulnerabilities

Vulnerabilities for packages: spire-server-fips, gitsign, cloudbeat-fips, trivy-operator, tkn, chainctl-fips, zarf-fips, falcoctl, neuvector-sigstore-interface, policy-controller-fips, tkn-fips, kyverno-notation-aws-fips, slsa-verifier, falcoctl-fips, ko-fips, tbot, policy-controller,...

CVE-2026-48042

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O100K nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1...

EUVD-2026-39145

Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing...

ROS-20260625-73-0016

The vulnerability of the ASN.1 library Libtasn1 is related to its algorithmic complexity. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2026-9785

Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing...

CVE-2026-48028

Mastodon (open-source social network server) versions prior to 4.5.10, 4.4.17, and 4.3.23 are affected. The vulnerability arises from how incoming activities signed with Linked-Data Signatures are normalized, failing to adequately protect against a class of spoofing that lets an attacker remove J...

CVE-2026-46349 Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures does not sufficiently protect the activities from a certain class of spoofing, allowing attackers to...