CVE-2026-37736

HighCVSS 7.5/10Last modified Sep 9, 2026

Description

An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Aug 28, 2026
Last modified: Sep 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-377376.5sanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.ma CVE-2026-37747.5The application allows PDF JavaScript and document/print actions (such as WillPrint/DidPrint) to update form fields, annotations, or optiona CVE-2026-377487.2Visitor Management System 1.0 by sanjay1313 is vulnerable to Unrestricted File Upload in vms/php/admin_user_insert.php and vms/php/update_1.CVE-2026-377499.8A SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote unauthenticated attackers to bypass authen CVE-2026-37757.8The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories wri CVE-2026-377506.1A reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1 allows unauthenticated remote attackers to ex CVE-2026-377519.8An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attac CVE-2026-37765.5The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources. When a PDF cont CVE-2026-37777.8The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document z CVE-2026-37785.5The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations a CVE-2026-37797.8The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which CVE-2026-37807.8The application's installer runs with elevated privileges but resolves system executables and DLLs using untrusted search paths that can inc