CVE Vulnerability Catalog

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references, so a filter that removes the last single-key filter frees the callback table while the decode is in progress.

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, the class name and argument array are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. For an array or hash object with a "" overload, and from 4.20 a scalar object, it takes an extra reference that is never released.

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.

Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. Callbacks and the incremental parse buffer are copied as raw scalar pointers, so the child's parser uses and later frees scalars that belong to the parent.

A vulnerability in the Cpanel::JSON::XS Perl library (versions 4.20 to 4.80) causes an out-of-bounds write during canonical encoding of a tied or threads::shared hash when the key count grows between the first and second pass. This can corrupt stack or heap memory and crash the process.

In the Cpanel::JSON::XS Perl library (versions before 4.80), incr_parse buffers input beyond max_size because it compares parsing progress rather than buffer length. A chunk starting with a NUL byte or a call in void context bypasses the check, allowing unbounded buffer growth and memory exhaustion.

In the Cpanel::JSON::XS Perl library (versions 4.28 to 4.80), the dupkeys_as_arrayref option leaks the array collecting duplicate key values in decode_hv — an extra reference is never released, so the array and its values outlive the decoded structure. The leak also occurs when decoding fails after a duplicate key.

In the Cpanel::JSON::XS Perl library (versions before 4.80), with allow_bignum, numbers in exponent notation are encoded as full decimal digits, which can lead to memory exhaustion. A small text such as [1e30000000] can encode to about 30 MB because the exponent is unbounded.

In the Cpanel::JSON::XS Perl library (versions 4.33 to 4.80), the allow_barekey option in decode_hv accepts malformed UTF-8 in bare keys because the key bytes are stored as a UTF-8 flagged string without validation. Later operations on such a key, such as lc, uc or re-encoding the hash, die with a malformed UTF-8 error.

In the Cpanel::JSON::XS Perl library (versions 4.33 to 4.80), duplicate non-ASCII bare keys are not detected, leading to type confusion under dupkeys_as_arrayref in decode_hv. A repeated key replaces the earlier value, and a further repeat may treat the value as an array and dereference a pointer from a JSON number.

In the Cpanel::JSON::XS Perl library (versions before 4.80), the allow_tags option in decode_tag allows stack exhaustion via nested tagged values. Tag nesting is not counted against max_depth, so a run of "(" bytes can exhaust the C stack and trigger an uncatchable segmentation fault.

In the Cpanel::JSON::XS Perl library (versions before 4.80), the decoded key of an object rejected for a duplicate key or a missing colon leaks in decode_hv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is not freed when the object is rejected.

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend, resulting in remote code execution as the server process.

Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability allowing remote attackers to impersonate the trusted address bar by entering fullscreen mode via the Fullscreen API without a persistent notification or trusted-origin indicator. After a single user tap, attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content.

GPAC Project/MP4Box version 2.5-DEV-rev1593-gfe88c3545-master contains a heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c). An attacker can supply a crafted AC4 file to cause a denial of service (DoS).

IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms. This could allow an attacker to decrypt highly sensitive information.

Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing io.element.call:// URLs. If an attacker tricks a user into opening a maliciously crafted io.element.call:// URL, they can load an attacker-controlled origin inside the call screen's WKWebView, which is granted device microphone and camera permissions (if previously granted to the app).

IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code that, when viewed, is executed in the victim's web browser within the security context of the hosting site.

IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.