CVE-2026-61634 vulnerabilities

Vulnerabilities for packages: zipkin, logstash, druid, thingsboard, cassandra-reaper...

CVE-2026-55643

Snipe-IT (IT asset/license management system) prior to 8.6.3 contains a tenant isolation bypass in FMCS floater mode. A company-scoped user can access users whose company_id is null because broad API queries and bulk web actions fail to consistently apply the isCurrentUserHasAccess authorization ...

CVE-2026-55643 Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose companyid is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/id/licenses...

CVE-2026-71865

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...

CVE-2026-17183

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

CVE-2026-71865 Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...

CVE-2026-71865

Orval (a TypeScript client generator for OpenAPI/Swagger specs) is vulnerable to import-time remote code execution prior to version 8.21.0 . A double quote in a query parameter name is emitted into the generated zod.object({...}) schema without safe encoding, enabling computed-property-key inject...

CVE-2026-71865 Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...

CVE-2026-72716 Orval: Import-time RCE via query-parameter default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permit...

CVE-2026-62681 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...

CVE-2026-62681

In Orval

CVE-2026-62681 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...

CVE-2026-17183 CVE-2026-17183 CVE Record

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

CVE-2026-17183 CVE-2026-17183 CVE Record

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

CVE-2026-17183

In Grafana OSS (confirmed 13.0.1), the Unified Alerting/ngalert component skips datasource authorization when queryType equals __expr__, but execution uses the real datasourceUid. An authenticated low-privileged user can set queryType: "__expr__" with a real datasource UID to bypass datasources:q...

CVE-2026-63408

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints...

CVE-2026-63408

In Grav API Plugin before 1.0.0-rc.16, JwtAuthenticator::extractBearerToken() accepts a JWT via the ?token= URL query parameter on all /api/v1 routes, exposing valid tokens in Apache/proxy/CDN logs, browser history, and Referer headers. An attacker with access to those records can reuse the token...

EUVD-2026-62547

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints...

CVE-2026-63408 Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints...

CVE-2026-18756

HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-membership-form, lure an authenticated...