CVE-2026-111695

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

PT-2026-116094

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

libtaxii

libtaxii A Python library for handling Trusted Automated eXchange of Indicator Information TAXII™ v1.x Messages and invoking TAXII Services. :Source: https://github.com/TAXIIProject/libtaxii/ :Documentation: https://libtaxii.readthedocs.io/ :Information: https://taxiiproject.github.io/ :Download:...

CVE-2021-41277_SSRF

CVE-2021-41277SSRF CVE-2021-41277 can be extended to an SSRF Description Metabase is an open source data analytics platform. Metabase versions 0.40.5 were affected by CVE-2021-41277 which led to local file inclusion according to the CVE description. While analyzing the finding described in Metaba...

CVE-2026-97394

The kin-openapi Go project (versions 0.136.0 through 0.143.0 ) contains a nil-pointer dereference vulnerability in the openapi3filter component. This occurs when the application processes OpenAPI 3.1 array schemas that lack the items keyword. During the decoding of application/x-www-form-urlencod...

CVE-2026-97394

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies,...

CVE-2026-108384 dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bare string

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parsefixed interpolates a fixed type's aliases value directly into a generated types.confixed...

CVE-2026-108378: Improper Control of Generation of Code

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.renderdocstring copies a schema record's doc value into a generated triple-double-quoted...

CVE-2026-108379: Improper Control of Generation of Code

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parsefixed inserts a fixed type's namespace value between quotes inside a generated types.confix...

[SECURITY] Fedora 45 Update: mallard-rng-1.1.0-18.fc45

RELAX NG schemas for all Mallard versions and extensions that have been marked final...

[SECURITY] Fedora 45 Update: docbook5-schemas-5.1-19.fc45

Docbook 5.X is a complete rewrite of Docbook in RELAX NG and not compatible with previous Docbook versions. This package contains Relax NG , DTD and W3C schema for Docbook 5.X. Syntax of those schemas is XML-compliant and is developed by the OASIS consortium...

NPM: fastify vulnerable to request validation bypass via skipped boolean false schemas

NPM: fastify vulnerable to request validation bypass via skipped boolean false schemas vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...

[SECURITY] Fedora 45 Update: gsettings-desktop-schemas-51.0-1.fc45

gsettings-desktop-schemas contains a collection of GSettings schemas for settings shared by various components of a desktop...

CentOS Linux 8 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-static / python3-libxml2 Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2025:1742466508)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2025:1742466508 advisory. - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and...

CVE-2026-77883

Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access LinkedAccount's if...

Astra Linux – Vulnerability in Ruby-Nokogiri

Nokogiri is a Rubygem that provides HTML, XML, SAX, and Reader parsers, with support for XPath and CSS selectors. In Nokogiri versions prior to 1.11.0.rc4, there was an XXE vulnerability. XML schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accesse...

CVE-2026-77883

Apache Syncope versions 3.0.0-M0 through 3.0.16 , 4.0.0-M0 through 4.0.7 , and 4.1.0-M0 through 4.1.2 are vulnerable to an information disclosure flaw. An administrator with entitlements for Derived Schemas can create a malicious JEXL expression that enables any administrator with User read entit...

CVE-2026-77883 Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access LinkedAccount's if...

CVE-2026-77883 Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access LinkedAccount's if...

EUVD-2026-77441

Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access LinkedAccount's if...