Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,236 results · page 11 of 25
Sep 15, 2025The OCPP implementation in libocpp before 0.26.2 allows a denial of service (EVerest crash) via JSON input larger than 255 characters, because a CiString<255> oCVE-2025-59398 · Other software · EVerest · reported by MITRELow 3.1
The OCPP implementation in libocpp before 0.26.2 allows a denial of service (EVerest crash) via JSON input larger than 255 characters, because a CiString<255> object is created with StringTooLarge set to Throw.
- Product
- libocpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registeCVE-2025-43789 · Other software · Liferay · reported by security@liferay.comLow 1
JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked directly as classes which allows Service Access Policies get executed.
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin.CVE-2025-9910 · Other software · reported by report@snyk.ioLow 1.3
Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used as source for the diff, and the result renderer using the built-in html formatter on a private website.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbenjamine.github.iogithub.com
Sep 8, 2025JSON::SIMD before version 1.07 and earlier for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attaCVE-2025-40930 · Other software · PJUHASZ · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.5
JSON::SIMD before version 1.07 and earlier for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact.
- Product
- JSON::SIMD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Sep 8, 2025Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks orCVE-2025-40929 · Other software · RURBAN · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.6
Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact
- Product
- Cpanel::JSON::XS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Sep 8, 2025JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other uCVE-2025-40928 · Other software · MLEHMANN · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.5
JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact
- Product
- JSON::XS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgsecurity.metacpan.org
Sep 3, 2025cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass arCVE-2025-57052 · Other software · Davegamble · reported by MITRECritical 9.8
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
- Product
- Cjson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordx-0r.comlists.debian.org
Aug 29, 2025Payload uses JSON Web Tokens (JWT) for authentication.CVE-2025-4643 · Other software · Payload CMS · reported by cvd@cert.plMedium 6.3
Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed). This issue has been fixed in version 3.44.0 of Payload.
- Product
- Payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2025In the PrepareCDExportJSON.pl service, the "getPerfServiceIds" function is vulnerable to SQL injection.CVE-2025-30059 · Other software · CGM · reported by cvd@cert.plMedium 6.9
In the PrepareCDExportJSON.pl service, the "getPerfServiceIds" function is vulnerable to SQL injection.
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025A denial of service vulnerability exists in the JSONReader component of the run-llama/llama_index repository, specifically in version v0.12.37.CVE-2025-5302 · Other software · run-llama · reported by security@huntr.devHigh 8.6
A denial of service vulnerability exists in the JSONReader component of the run-llama/llama_index repository, specifically in version v0.12.37. The vulnerability is caused by uncontrolled recursion when parsing deeply nested JSON files, which can lead to Python hitting its maximum recursion depth limit. This results in high resource consumption and potential crashes of the Python process. The issue is resolved in version 0.12.38.
- Product
- run-llama/llama_index
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation.CVE-2025-51606 · Other software · reported by MITREHigh 8.8
hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical security risk in systems where authentication and authorization rely on the integrity of JWTs.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025The StrongDM macOS client incorrectly processed JSON-formatted messages.CVE-2025-6183 · Other software · StrongDM · reported by ebf2cdfb-f390-4894-8ec9-f81bf1c57e6bHigh 7
The StrongDM macOS client incorrectly processed JSON-formatted messages. Attackers could potentially modify macOS system configuration by crafting a malicious JSON message.
- Product
- sdm-cli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025Structured Content (JSON-LD) #wpsc: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-3414 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Structured Content (JSON-LD) #wpsc WordPress plugin before 1.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Structured Content (JSON-LD) #wpsc
- Fixed in
- 1.7.0
- What to do
- Update Structured Content (JSON-LD) #wpsc to 1.7.0 or newer.
Aug 13, 2025The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set_timesetting action with the nCVE-2025-43989 · Other software · reported by MITREMedium 6.5
The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set_timesetting action with the ntpserver0 parameter, which is used in a system command. By setting a username=admin cookie (bypassing normal session checks), an unauthenticated attacker can use that parameter to execute arbitrary OS commands.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.proton.medrive.proton.me
Aug 13, 2025CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON fileCVE-2025-52386 · Other software · reported by MITREMedium 5.4
CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2025jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard.CVE-2025-54887 · Other software · jwt · reported by GitHubCritical 9.1
jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. This puts users at risk because JWEs can be modified to decrypt to an arbitrary value, decrypted by observing parsing differences and the GCM internal GHASH key can be recovered. Users are affected by this vulnerability even if they do not use an AES-GCM encryption algorithm for their JWEs. As the GHASH key may have been leaked, users must rotate the encryption keys after upgrading. This issue is fixed in version 1.1.1.
- Product
- ruby-jwe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2025ERC (aka Emotion Recognition in Conversation) through 0.3 has insecure deserialization via a serialized object because jsonpickle is used.CVE-2025-55136 · Other software · tae898 · reported by MITREMedium 5.7
ERC (aka Emotion Recognition in Conversation) through 0.3 has insecure deserialization via a serialized object because jsonpickle is used.
- Product
- ERC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.CVE-2024-58264 · Other software · CosmWasm · reported by MITRELow 3.2
The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.
- Product
- serde-json-wasm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2025A race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff.CVE-2025-25214 · Other software · WWBN · reported by talos-cna@cisco.comHigh 8.8
A race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A series of specially crafted HTTP request can lead to arbitrary code execution.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 17, 2025Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files.CVE-2025-6391 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.1
Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files. An attacker with access to the log files can withdraw the unencrypted tokens with security implications, such as unauthorized access, session hijacking, and information disclosure.
- Product
- Brocade ASCG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON objectCVE-2025-53864 · Other software · Connect2id · reported by MITREMedium 5.8
Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
- Product
- Nimbus JOSE+JWT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgbitbucket.org
Jul 7, 2025The JSONReader in run-llama/llama_index versions 0.12.28 is vulnerable to a stack overflow due to uncontrolled recursive JSON parsing.CVE-2025-5472 · Other software · run-llama · reported by security@huntr.devMedium 6.5
The JSONReader in run-llama/llama_index versions 0.12.28 is vulnerable to a stack overflow due to uncontrolled recursive JSON parsing. This vulnerability allows attackers to trigger a Denial of Service (DoS) by submitting deeply nested JSON structures, leading to a RecursionError and crashing applications. The root cause is the unsafe recursive traversal design and lack of depth validation, which makes the JSONReader susceptible to stack overflow when processing deeply nested JSON. This impacts the availability of services, making them unreliable and disrupting workflows. The issue is resolved in version 0.12.38.
- Product
- run-llama/llama_index
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2025A critical deserialization vulnerability exists in the run-llama/llama_index library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12CVE-2025-3108 · Other software · run-llama · reported by security@huntr.devHigh 7.5
A critical deserialization vulnerability exists in the run-llama/llama_index library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle module. JsonPickleSerializer prioritizes deserialization using pickle.loads(), which can execute arbitrary code when processing untrusted data. Attackers can exploit this by crafting malicious payloads to achieve full system compromise. The root cause includes an insecure fallback mechanism, lack of validation or safeguards, misleading design, and violation of Python security guidelines.
- Product
- run-llama/llama_index
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recurCVE-2025-6710 · Other software · MongoDB Inc · reported by cna@mongodb.comHigh 7.5
MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack space consumption. Such inputs can lead to a stack overflow that causes the server to crash which could occur pre-authorisation. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5. The same issue affects MongoDB Server v6.0 versions prior to 6.0.21, but an attacker can only induce denial of service after authenticating.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authenticaCVE-2025-6709 · Other software · MongoDB Inc · reported by cna@mongodb.comHigh 7.5
The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentication. This can be reproduced using the mongo shell to send a malicious JSON payload leading to an invariant failure and server crash. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5. The same issue affects MongoDB Server v6.0 versions prior to 6.0.21, but an attacker can only induce denial of service after authenticating.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025The affected products contain JSON Web Tokens (JWT) that do not expire, which could allow an attacker to gain access to the system.CVE-2025-49152 · Other software · Microsens · reported by ics-cert@hq.dhs.govHigh 8.7
The affected products contain JSON Web Tokens (JWT) that do not expire, which could allow an attacker to gain access to the system.
- Product
- NMP Web+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025The affected products could allow an unauthenticated attacker to generate forged JSON Web Tokens (JWT) to bypass authentication.CVE-2025-49151 · Other software · Microsens · reported by ics-cert@hq.dhs.govCritical 9.3
The affected products could allow an unauthenticated attacker to generate forged JSON Web Tokens (JWT) to bypass authentication.
- Product
- NMP Web+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025jq is a command-line JSON processor.CVE-2025-49014 · Other software · jqlang · reported by GitHubMedium 5.5
jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.
- Product
- jq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025parse_string in cJSON before 1.7.18 has a heap-based buffer over-read via {"1":1, with no trailing newline if cJSON_ParseWithLength is called.CVE-2023-53154 · Other software · cJSON project · reported by MITRELow 2.9
parse_string in cJSON before 1.7.18 has a heap-based buffer over-read via {"1":1, with no trailing newline if cJSON_ParseWithLength is called.
- Product
- cJSON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Actors can use a maliciously crafted JavaScript object notation (JSON) web token (JWT) to perform privilege escalation by submitting the malicious JWT to a vulnCVE-2025-4692 · Other software · ABUP · reported by ics-cert@hq.dhs.govMedium 5.9
Actors can use a maliciously crafted JavaScript object notation (JSON) web token (JWT) to perform privilege escalation by submitting the malicious JWT to a vulnerable method exposed on the cloud platform. If the exploit is successful, the user can escalate privileges to access any device managed by the ABUP Cloud Update Platform.
- Product
- ABUP IoT Cloud Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025ejson2env allows users to decrypt EJSON secrets and export them as environment variables.CVE-2025-48069 · Other software · Shopify · reported by GitHubMedium 6.6
ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the `ejson2env` tool has a vulnerability related to how it writes to `stdout`. Specifically, the tool is intended to write an export statement for environment variables and their values. However, due to inadequate output sanitization, there is a potential risk where variable names or values may include malicious content, resulting in additional unintended commands being output to `stdout`. If this output is improperly utilized in further command execution, it could lead to command injection, allowing an attacker to execute arbitrary commands on the host system. Version 2.0.8 sanitizes output during decryption. Other mitigations involve avoiding use of `ejson2env` to decrypt untrusted user secrets and/or avoiding evaluating or executing the direct output from `ejson2env` without removing nonprintable characters.
- Product
- ejson2env
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025jq is a command-line JSON processor.CVE-2025-48060 · Other software · jqlang · reported by GitHubHigh 7.7
jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.
- Product
- jq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
May 21, 2025jq is a command-line JSON processor.CVE-2024-23337 · Other software · jqlang · reported by GitHubMedium 4.3
jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.
- Product
- jq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025Incorrect JSON input stringification in Google's Tensorflow serving versions up to 2.18.0 allows for potentially unbounded recursion leading to server crash.CVE-2025-0649 · Computers, phones & browsers · Google · reported by cve-coordination@google.comHigh 8.9
Incorrect JSON input stringification in Google's Tensorflow serving versions up to 2.18.0 allows for potentially unbounded recursion leading to server crash.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Incorrect access control in the component /config/download of DBSyncer v2.0.6 allows attackers to access the JSON file containing sensitive account information,CVE-2025-45237 · Other software · Dbsyncer Project · reported by MITREHigh 7.5
Incorrect access control in the component /config/download of DBSyncer v2.0.6 allows attackers to access the JSON file containing sensitive account information, including the encrypted password.
- Product
- Dbsyncer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 24, 2025Due to improper JSON Web Tokens implementation an unauthenticated remote attacker can guess a valid session ID and therefore impersonate a user to gain full accCVE-2021-47663 · Other software · Franka Robotics · reported by info@cert.vde.comHigh 8.1
Due to improper JSON Web Tokens implementation an unauthenticated remote attacker can guess a valid session ID and therefore impersonate a user to gain full access.
- Product
- Franka Emika Robot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2025mystrtod in mjson 1.2.7 requires more than a billion iterations during processing of certain digit strings such as 8891110122900e913013935755114.CVE-2023-30421 · Other software · mjson project · reported by MITRELow 2.9
mystrtod in mjson 1.2.7 requires more than a billion iterations during processing of certain digit strings such as 8891110122900e913013935755114.
- Product
- mjson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2025cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678CVE-2023-26819 · Other software · cJSON Project · reported by MITRELow 2.9
cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.
- Product
- cJSON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Apr 18, 2025An issue in WorldCast Systems ECRESO FM/DAB/TV Transmitter v1.10.1 allows authenticated attackers to escalate privileges via a crafted JSON payload.CVE-2025-28237 · Other software · reported by MITREHigh 8.8
An issue in WorldCast Systems ECRESO FM/DAB/TV Transmitter v1.10.1 allows authenticated attackers to escalate privileges via a crafted JSON payload.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2025A vulnerability, which was classified as problematic, has been found in joelittlejohn jsonschema2pojo 1.2.2.CVE-2025-3588 · Other software · joelittlejohn · reported by VulDBMedium 4.8
A vulnerability, which was classified as problematic, has been found in joelittlejohn jsonschema2pojo 1.2.2. This issue affects the function apply of the file org/jsonschema2pojo/rules/SchemaRule.java of the component JSON File Handler. The manipulation leads to stack-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- jsonschema2pojo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025JSON Structuring Markup: Cross-Site Request Forgery (CSRF)CVE-2025-31908 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sami Ahmed Siddiqui JSON Structuring Markup json-structuring-markup allows Stored XSS.This issue affects JSON Structuring Markup: from n/a through <= 0.1.
- Product
- JSON Structuring Markup
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update JSON Structuring Markup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responses.CVE-2024-58130 · Other software · MISP · reported by MITREHigh 7.2
In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responses.
- Product
- MISP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2025golang-jwt is a Go implementation of JSON Web Tokens.CVE-2025-30204 · Other software · golang-jwt · reported by GitHubHigh 7.5
golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
- Product
- jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server.CVE-2024-8616 · Other software · h2oai · reported by security@huntr.devHigh 8.2
In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the `exportModelDetails` function in `ModelsHandler.java`, where the user-controllable `mexport.dir` parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL injection via prompt iCVE-2024-12911 · Other software · run-llama · reported by security@huntr.devHigh 7.1
A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is fixed in version 0.5.1.
- Product
- run-llama/llama_index
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a kCVE-2024-10707 · Other software · gaizhenbiao · reported by security@huntr.devMedium 6.5
gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a known issue (CVE-2024-4941). This vulnerability allows unauthenticated users to access arbitrary files on the server by uploading a specially crafted JSON file and exploiting the improper input validation in the handle_dataset_selection function.
- Product
- gaizhenbiao/chuanhuchatgpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2025A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json.CVE-2024-7631 · Other software · Red Hat · reported by Red HatMedium 4.3
A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.go#L112 Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console's pod by using sequences of ../ and valid directory paths.
- Product
- Red Hat OpenShift Container Platform 3.11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Mar 19, 2025fast-jwt provides fast JSON Web Token (JWT) implementation.CVE-2025-30144 · Other software · nearform · reported by GitHubMedium 6.5
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 5.0.6, the fast-jwt library does not properly validate the iss claim based on the RFC 7519. The iss (issuer) claim validation within the fast-jwt library permits an array of strings as a valid iss value. This design flaw enables a potential attack where a malicious actor crafts a JWT with an iss claim structured as ['https://attacker-domain/', 'https://valid-iss']. Due to the permissive validation, the JWT will be deemed valid. Furthermore, if the application relies on external libraries like get-jwks that do not independently validate the iss claim, the attacker can leverage this vulnerability to forge a JWT that will be accepted by the victim application. Essentially, the attacker can insert their own domain into the iss array, alongside the legitimate issuer, and bypass the intended security checks. This issue is fixed in 5.0.6.
- Product
- fast-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orggithub.com
Mar 12, 2025JSON is a JSON implementation for Ruby.CVE-2025-27788 · Other software · ruby · reported by GitHubHigh 7.5
JSON is a JSON implementation for Ruby. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions prior to 2.10.0 are not vulnerable. Version 2.10.2 fixes the problem. No known workarounds are available.
- Product
- json
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages.CVE-2025-27615 · Other software · umati · reported by GitHubHigh 8.2
umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be publicly accessible with umatiGateway's provided docker-compose file. With this access, the configuration can be viewed and altered. Commit 5d81a3412bc0051754a3095d89a06d6d743f2b16 uses `127.0.0.1:8080:8080` to limit access to the local network. For those who are unable to use this proposed patch, a firewall on Port 8080 may block remote access, but the workaround may not be perfect because Docker may also bypass a firewall by its iptable based rules for port forwarding.
- Product
- umatiGateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.