Overview 147 matches · 19 in Waratek scope · 5 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
147matches
19in Waratek scope12.9%
5protected3.4%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
5
3.4%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
14
9.5%
Outside Waratek scope
0
0.0%
Not applicable
127
86.4%
Withdrawn CVE
1
0.7%
blocked by ARMR today
5
3.4%
partly blocked
0
0.0%
not blocked
142
96.6%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
147
100.0%
split by
peak 39 / year
20102
Not applicable2
Medium2
not blocked2
No public exploit2
20110
20120
20131
Not applicable1
High1
not blocked1
No public exploit1
20142
Not applicable2
Medium2
not blocked2
No public exploit2
20151
Not applicable1
Medium1
not blocked1
No public exploit1
20161
Not applicable1
High1
not blocked1
No public exploit1
20174
Not applicable4
High2
Medium2
not blocked4
No public exploit4
201813
No exploit published2
Not applicable11
Critical2
High10
Medium1
not blocked13
No public exploit13
20199
Protected by Waratek1
Not applicable8
Critical3
High5
Medium1
blocked by ARMR today1
not blocked8
No public exploit9
202018
Protected by Waratek2
No exploit published1
Not applicable15
Critical7
High10
Medium1
blocked by ARMR today2
not blocked16
No public exploit18
202139
Protected by Waratek2
No exploit published2
Not applicable34
Withdrawn CVE1
Critical10
High12
Medium16
Unknown1
blocked by ARMR today2
not blocked37
No public exploit39
202217
Not applicable17
Critical7
High5
Medium5
not blocked17
No public exploit17
202318
No exploit published6
Not applicable12
Critical5
High8
Medium5
not blocked18
No public exploit18
20246
No exploit published1
Not applicable5
Critical2
High2
Medium2
not blocked6
No public exploit6
20256
Not applicable6
Critical1
High2
Medium3
not blocked6
No public exploit6
202610
No exploit published2
Not applicable8
Critical1
High5
Medium4
not blocked10
No public exploit10
201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-18140 | High | 2026-07-30 | Not applicable | No public exploit | Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP request containing deeply nested JSON to a smithy-rs generated server. To remediate this issue, users should upgrade to aws-smithy-json 0.62.7 or later and rebuild. |
| CVE-2026-67215 | High | 2026-07-29 | Not applicable | No public exploit | cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service. |
| CVE-2026-16554 | Medium | 2026-07-27 | Not applicable | No public exploit | cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service. Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions. |
| CVE-2026-52746 | High | 2026-07-17 | Not applicable | No public exploit | JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0 and 1.8.9. |
| CVE-2026-54911 | Medium | 2026-06-22 | Not applicable | No public exploit | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different Unicode characters instead of rejecting them. This leads to input validation bypass and data integrity issues. This vulnerability is fixed in 5.13.0. |
| CVE-2026-34481 | Medium | 2026-04-10 | No exploit published | No public exploit | Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records. An attacker can exploit this issue only if both of the following conditions are met: * The application uses JsonTemplateLayout. * The application logs a MapMessage, or logs an object directly (e.g., via Logger.info(Object), which wraps it in an ObjectMessage), where the message contains an attacker-controlled floating-point value. Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue. Note: The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the MapMessage.asJson() serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1. |
| CVE-2026-33210 | High | 2026-03-20 | Not applicable | No public exploit | Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2. |
| CVE-2026-32874 | High | 2026-03-20 | Not applicable | No public exploit | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory leak in JSON parsing large (outside of the range [-2^63, 2^64 - 1]) integers. The leaked memory is a copy of the string form of the integer plus an additional NULL byte. The leak occurs irrespective of whether the integer parses successfully or is rejected due to having more than sys.get_int_max_str_digits() digits, meaning that any sized leak per malicious JSON can be achieved provided that there is no limit on the overall size of the payload. Any service that calls ujson.load()/ujson.loads()/ujson.decode() on untrusted inputs is affected and vulnerable to denial of service attacks. This issue has been fixed in version 5.12.0. |
| CVE-2025-61140 | Critical | 2026-01-28 | Not applicable | No public exploit | The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution. |
| CVE-2026-24802 | Medium | 2026-01-27 | No exploit published | No public exploit | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in briandilley jsonrpc4j (src/main/java/com/googlecode/jsonrpc4j modules). This vulnerability is associated with program files NoCloseOutputStream.Java. This issue affects jsonrpc4j: through 1.6.0. |
| CVE-2025-10926 | Medium | 2025-10-30 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS).This issue affects JSON Field: from 0.0.0 before 1.5. |
| CVE-2025-9552 | Medium | 2025-10-10 | Not applicable | No public exploit | Vulnerability in Drupal Synchronize composer.Json With Contrib Modules.This issue affects Synchronize composer.Json With Contrib Modules: *.*. |
| CVE-2025-57320 | Medium | 2025-09-24 | Not applicable | No public exploit | json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-schema-editor-visual versions thru 1.1.1 allows attackers to inject or delete properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. |
| CVE-2025-57318 | High | 2025-09-24 | Not applicable | No public exploit | A Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. |
| CVE-2024-58264 | High | 2025-07-27 | Not applicable | No public exploit | The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data. |
| CVE-2024-13258 | Critical | 2025-01-09 | Not applicable | No public exploit | Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13. |
| CVE-2024-47855 | Medium | 2024-10-04 | No exploit published | No public exploit | util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string. |
| CVE-2024-38723 | Medium | 2024-07-22 | Not applicable | No public exploit | Server-Side Request Forgery (SSRF) vulnerability in Bernhard Kux JSON Content Importer.This issue affects JSON Content Importer: from n/a through 1.5.6. |
| CVE-2024-6624 | Critical | 2024-07-11 | Not applicable | No public exploit | The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on custom user meta fields. This makes it possible for unauthenticated attackers to register as administrators on the site. The plugin requires the JSON API plugin to also be installed. |
| CVE-2024-27307 | Critical | 2024-03-06 | Not applicable | No public exploit | JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions. This issue has been fixed in JSONata versions 1.8.7 and 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. As a workaround, one may apply the patch manually. |
| CVE-2024-27454 | High | 2024-02-26 | Not applicable | No public exploit | orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents. |
| CVE-2023-5123 | High | 2024-02-14 | Not applicable | No public exploit | The JSON datasource plugin ( https://grafana.com/grafana/plugins/marcusolsson-json-datasource/ ) is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing JSON data from a remote endpoint (including a specific sub-path) configured by an administrator. Due to inadequate sanitization of the dashboard-supplied path parameter, it was possible to include path traversal characters (../) in the path parameter and send requests to paths on the configured endpoint outside the configured sub-path. This means that if the datasource was configured by an administrator to point at some sub-path of a domain (e.g. https://example.com/api/some_safe_api/ ), it was possible for an editor to create a dashboard referencing the datasource which issues queries containing path traversal characters, which would in turn cause the datasource to instead query arbitrary subpaths on the configured domain (e.g. https://example.com/api/admin_api/) . In the rare case that this plugin is configured by an administrator to point back at the Grafana instance itself, this vulnerability becomes considerably more severe, as an administrator browsing a maliciously configured panel could be compelled to make requests to Grafana administrative API endpoints with their credentials, resulting in the potential for privilege escalation, hence the high score for this vulnerability. |
| CVE-2023-51074 | Medium | 2023-12-27 | No exploit published | No public exploit | json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method. |
| CVE-2023-6268 | Medium | 2023-12-26 | Not applicable | No public exploit | The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin |
| CVE-2023-50471 | High | 2023-12-14 | Not applicable | No public exploit | cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c. |
| CVE-2023-50773 | Medium | 2023-12-13 | No exploit published | No public exploit | Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2023-50772 | Medium | 2023-12-13 | No exploit published | No public exploit | Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2023-49145 | High | 2023-11-27 | No exploit published | No public exploit | Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary JavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0-M1 is the recommended mitigation. |
| CVE-2023-5072 | High | 2023-10-12 | No exploit published | No public exploit | Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used. |
| CVE-2023-3040 | High | 2023-06-14 | Not applicable | No public exploit | A debug function in the lua-resty-json package, up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a (merged in PR #14) contained an out of bounds access bug that could have allowed an attacker to launch a DoS if the function was used to parse untrusted input data. It is important to note that because this debug function was only used in tests and demos, it was not exploitable in a normal environment. |
| CVE-2022-47937 | Critical | 2023-05-15 | No exploit published | No public exploit | Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to consider the Apache Sling Commons Johnzon OSGi bundle provided by the Apache Sling project, but may of course use other JSON libraries. |
| CVE-2023-25485 | Medium | 2023-04-25 | Not applicable | No public exploit | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bernhard Kux JSON Content Importer plugin <= 1.3.15 versions. |
| CVE-2021-4329 | Critical | 2023-03-05 | Not applicable | No public exploit | A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some unknown functionality of the file logic.js. The manipulation leads to command injection. Upgrading to version 2.0.1 is able to address this issue. The patch is identified as c1dd82f5b15d8a553bb7a0cfa841ab8a11a9c227. It is recommended to upgrade the affected component. VDB-222266 is the identifier assigned to this vulnerability. |
| CVE-2023-23088 | Critical | 2023-02-03 | Not applicable | No public exploit | Buffer OverFlow Vulnerability in Barenboim json-parser master and v1.1.0 fixed in v1.1.1 allows an attacker to execute arbitrary code via the json_value_parse function. |
| CVE-2023-23087 | Critical | 2023-02-03 | Not applicable | No public exploit | An issue was found in MojoJson v1.2.3 allows attackers to execute arbitary code via the destroy function. |
| CVE-2023-23086 | Critical | 2023-02-03 | Not applicable | No public exploit | Buffer OverFlow Vulnerability in MojoJson v1.2.3 allows an attacker to execute arbitrary code via the SkipString function. |
| CVE-2022-45496 | High | 2023-02-03 | Not applicable | No public exploit | Buffer overflow vulnerability in function json_parse_string in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows attackers to code arbitrary code and gain escalated privileges. |
| CVE-2022-45493 | High | 2023-02-03 | Not applicable | No public exploit | Buffer overflow vulnerability in function json_parse_key in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows attackers to code arbitrary code and gain escalated privileges. |
| CVE-2022-45492 | High | 2023-02-03 | Not applicable | No public exploit | Buffer overflow vulnerability in function json_parse_number in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows attackers to code arbitrary code and gain escalated privileges. |
| CVE-2022-45491 | High | 2023-02-03 | Not applicable | No public exploit | Buffer overflow vulnerability in function json_parse_value in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows attackers to code arbitrary code and gain escalated privileges. |
| CVE-2018-25053 | Medium | 2022-12-28 | Not applicable | No public exploit | A vulnerability was found in moappi Json2html up to 1.1.x and classified as problematic. This issue affects some unknown processing of the file json2html.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.2.0 is able to address this issue. The name of the patch is 2d3d24d971b19a8ed1fb823596300b9835d55801. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216959. |
| CVE-2015-10004 | High | 2022-12-27 | Not applicable | No public exploit | Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC. |
| CVE-2022-4742 | Critical | 2022-12-26 | Not applicable | No public exploit | A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. Upgrading to version 0.6.2 is able to address this issue. The patch is identified as 859c9984b6c407fc2d5a0a7e47c7274daa681941. It is recommended to upgrade the affected component. VDB-216794 is the identifier assigned to this vulnerability. |
| CVE-2021-4279 | Critical | 2022-12-25 | Not applicable | No public exploit | A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 is able to address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability. |
| CVE-2022-46175 | High | 2022-12-24 | Not applicable | No public exploit | JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later. |
| CVE-2022-23539 | High | 2022-12-23 | Not applicable | No public exploit | Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option to `true` in the `sign()` and/or `verify()` functions. |
| CVE-2022-23541 | Medium | 2022-12-22 | Not applicable | No public exploit | jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0. |
| CVE-2022-23540 | High | 2022-12-22 | Not applicable | No public exploit | In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options. |
| CVE-2022-41382 | Critical | 2022-10-11 | Not applicable | No public exploit | The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0. |
| CVE-2022-38882 | Critical | 2022-09-19 | Not applicable | No public exploit | The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0. |
| CVE-2022-25921 | Critical | 2022-08-29 | Not applicable | No public exploit | All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor. |
| CVE-2022-23460 | High | 2022-08-19 | Not applicable | No public exploit | Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustion in an address sanitized (ASAN) build. This issue may lead to Denial of Service if the program using the jsonxx library crashes. This issue exists on the current commit of the jsonxx project and the project itself has been archived. Updates are not expected. Users are advised to find a replacement. |
| CVE-2022-23459 | Critical | 2022-08-19 | Not applicable | No public exploit | Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx use of the Value class may lead to memory corruption via a double free or via a use after free. The value class has a default assignment operator which may be used with pointer types which may point to alterable data where the pointer itself is not updated. This issue exists on the current commit of the jsonxx project. The project itself has been archived and updates are not expected. Users are advised to find a replacement. |
| CVE-2022-31117 | Medium | 2022-07-05 | Not applicable | No public exploit | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue. |
| CVE-2022-30241 | Medium | 2022-05-04 | Not applicable | No public exploit | The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by a SCRIPT element. |
| CVE-2022-23631 | Critical | 2022-02-09 | Not applicable | No public exploit | superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior authentication or knowledge. The only requirement is that the server implements at least one endpoint which uses superjson during request processing. This has been patched in superjson 1.8.1. Users are advised to update. There are no known workarounds for this issue. |
| CVE-2021-45958 | Medium | 2022-01-01 | Not applicable | No public exploit | UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation. |
| CVE-2021-3918 | Critical | 2021-11-13 | Not applicable | No public exploit | json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
| CVE-2020-23879 | High | 2021-11-10 | Not applicable | No public exploit | pdf2json v0.71 was discovered to contain a NULL pointer dereference in the component ObjectStream::getObject. |
| CVE-2020-23878 | Critical | 2021-11-10 | Not applicable | No public exploit | pdf2json v0.71 was discovered to contain a stack buffer overflow in the component XRef::fetch. |
| CVE-2021-23820 | Critical | 2021-11-03 | Not applicable | No public exploit | This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays. |
| CVE-2021-23807 | Critical | 2021-11-03 | Not applicable | No public exploit | This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays. |
| CVE-2021-23509 | Critical | 2021-11-03 | Not applicable | No public exploit | This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays. |
| CVE-2021-42836 | High | 2021-10-22 | Not applicable | No public exploit | GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack. |
| CVE-2021-3822 | High | 2021-09-27 | Not applicable | No public exploit | jsoneditor is vulnerable to Inefficient Regular Expression Complexity |
| CVE-2021-23441 | Unknown | 2021-09-19 | Withdrawn CVE | No public exploit | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none |
| CVE-2020-19475 | Medium | 2021-07-21 | Not applicable | No public exploit | An issue has been found in function CCITTFaxStream::lookChar in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an invalid write of size 2 . |
| CVE-2020-19474 | Medium | 2021-07-21 | Not applicable | No public exploit | An issue has been found in function Gfx::doShowText in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an Use After Free . |
| CVE-2020-19473 | Medium | 2021-07-21 | Not applicable | No public exploit | An issue has been found in function DCTStream::decodeImage in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an uncaught floating point exception. |
| CVE-2020-19472 | Medium | 2021-07-21 | Not applicable | No public exploit | An issue has been found in function DCTStream::readHuffSym in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an invalid read of size 2 . |
| CVE-2020-19471 | Medium | 2021-07-21 | Not applicable | No public exploit | An issue has been found in function DCTStream::decodeImage in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an invalid read of size 4 . |
| CVE-2020-19470 | Medium | 2021-07-21 | Not applicable | No public exploit | An issue has been found in function DCTStream::getChar in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a NULL pointer dereference (invalid read of size 1) . |
| CVE-2020-19469 | Medium | 2021-07-21 | Not applicable | No public exploit | An issue has been found in function DCTStream::reset in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an invalid write of size 8 . |
| CVE-2020-19468 | Medium | 2021-07-21 | Not applicable | No public exploit | An issue has been found in function EmbedStream::getChar in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a null pointer derefenrece (invalid read of size 8) . |
| CVE-2020-19467 | Medium | 2021-07-21 | Not applicable | No public exploit | An issue has been found in function DCTStream::transformDataUnit in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an Illegal Use After Free . |
| CVE-2020-19466 | Medium | 2021-07-21 | Not applicable | No public exploit | An issue has been found in function DCTStream::transformDataUnit in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an invalid read of size 1 . |
| CVE-2020-19465 | Medium | 2021-07-21 | Not applicable | No public exploit | An issue has been found in function ObjectStream::getObject in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an invalid read of size 4 . |
| CVE-2020-19464 | Medium | 2021-07-21 | Not applicable | No public exploit | An issue has been found in function XRef::fetch in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a stack overflow . |
| CVE-2020-19463 | Medium | 2021-07-21 | Not applicable | No public exploit | An issue has been found in function vfprintf in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a stack overflow. |
| CVE-2021-31684 | High | 2021-06-01 | No exploit published | No public exploit | A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request. |
| CVE-2018-1107 | Medium | 2021-03-30 | Not applicable | No public exploit | It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated. |
| CVE-2021-27568 | Medium | 2021-02-23 | Protected by Waratek | No public exploit | An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information. |
| CVE-2020-18750 | High | 2021-02-05 | Not applicable | No public exploit | Buffer overflow in pdf2json 0.69 allows local users to execute arbitrary code by converting a crafted PDF file. |
| CVE-2021-23900 | High | 2021-01-13 | No exploit published | No public exploit | OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations. |
| CVE-2021-23899 | Critical | 2021-01-13 | Protected by Waratek | No public exploit | OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents. |
| CVE-2020-23849 | Medium | 2021-01-11 | Not applicable | No public exploit | Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript. |
| CVE-2020-36067 | High | 2021-01-05 | Not applicable | No public exploit | GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call. |
| CVE-2020-36066 | High | 2021-01-05 | Not applicable | No public exploit | GJSON <1.6.5 allows attackers to cause a denial of service (remote) via crafted JSON. |
| CVE-2016-20008 | High | 2021-01-01 | Not applicable | No public exploit | The REST/JSON project 7.x-1.x for Drupal allows session enumeration, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. |
| CVE-2016-20007 | High | 2021-01-01 | Not applicable | No public exploit | The REST/JSON project 7.x-1.x for Drupal allows session name guessing, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. |
| CVE-2016-20006 | High | 2021-01-01 | Not applicable | No public exploit | The REST/JSON project 7.x-1.x for Drupal allows blockage of user logins, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. |
| CVE-2016-20005 | Critical | 2021-01-01 | Not applicable | No public exploit | The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. |
| CVE-2016-20004 | Critical | 2021-01-01 | Not applicable | No public exploit | The REST/JSON project 7.x-1.x for Drupal allows field access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. |
| CVE-2016-20003 | High | 2021-01-01 | Not applicable | No public exploit | The REST/JSON project 7.x-1.x for Drupal allows user enumeration, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. |
| CVE-2016-20002 | Critical | 2021-01-01 | Not applicable | No public exploit | The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. |
| CVE-2016-20001 | Critical | 2021-01-01 | Not applicable | No public exploit | The REST/JSON project 7.x-1.x for Drupal allows node access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. |
| CVE-2020-29203 | Critical | 2020-12-26 | Not applicable | No public exploit | struct2json before 2020-11-18 is affected by a Buffer Overflow because strcpy is used for S2J_STRUCT_GET_string_ELEMENT. |
| CVE-2020-22083 | Critical | 2020-12-17 | Not applicable | No public exploit | jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued that this is expected and clearly documented behaviour. pickle is known to be capable of causing arbitrary code execution, and must not be used with un-trusted data |
| CVE-2020-35381 | High | 2020-12-15 | Not applicable | No public exploit | jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call. |
| CVE-2020-35380 | High | 2020-12-15 | Not applicable | No public exploit | GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON. |