22713 matches found
EUVD-2026-52703
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...
CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...
CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...
CVE-2026-68494
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...
CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...
EUVD-2026-52699
The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...
CVE-2026-18401 jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service
The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...
CVE-2026-18401 jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service
The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...
CVE-2026-18401
The CVE describes a vulnerability in jackson-core’s non-blocking (async) JSON parser where maxNumberLength is not enforced, unlike the synchronous parser. Root cause: the async parsing path in NonBlockingUtf8JsonParserBase does not invoke number length validation; _finishNumberIntegralPart() accu...
CVE-2026-45694
creationtimestamp| type| source ---|---|--- 2026-08-04 11:55:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msaxdwrux325 2026-08-12 16:35:07+00:00| published-proof-of-concept| https://github.com/librenms/librenms/security/advisories/GHSA-jmqm-f8q4-v7wx...
MINI-J2HG-32G2-4F99
Bulletin has no description...
CVE-2026-18591
A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the component com.meesho.supply. Such manipulation of the argument userid/phone number/email address/name leads to cleartext storage of sensitive...
CVE-2026-18591 Meesho Online Shopping App com.meesho.supply cleartext storage
A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the component com.meesho.supply. Such manipulation of the argument userid/phone number/email address/name leads to cleartext storage of sensitive...
CVE-2025-71401
creationtimestamp| type| source ---|---|--- 2026-08-03 04:44:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms5os36ck22s 2026-08-04 11:24:49+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3msavnlqgs323...
CVE-2026-16614
creationtimestamp| type| source ---|---|--- 2026-08-01 17:35:34+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzyxryvnf2i 2026-08-01 17:36:07+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzyyqr2ya22 2026-08-01 19:00:39+00:00| seen|...
MINI-44PV-2M65-C8GX
Bulletin has no description...
DEBIAN-CVE-2026-67325
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like uploadp instead of uploadpack, which git resolves to dangerous...
CVE-2026-14561
The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...
CVE-2026-14561 Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure
The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...