CVE-2026-105125

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105125: Improper Limitation of a Pathname to a Restricted Directory

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105125 LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105125 LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105125 LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105125

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105125

LaraDashboard versions prior to 1.4.8 are vulnerable to a path traversal vulnerability within the /api/translations/{lang} endpoint. This flaw allows unauthenticated attackers to read sensitive JSON files, such as composer.json, by manipulating the {lang} route segment. Specifically, on Windows h...

CVE-2026-105117 OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions

OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/realm/users. Attackers can supply subject and message fields to send phishing mail from the...

PT-2026-104591

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

EUVD-2026-51271

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers...

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists which allows uncontrolled recursion in the unknown-key skip path of the...

GHSA-8FFR-XGWF-XJ56 aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists which allows uncontrolled recursion in the unknown-key skip path of the...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via JsonSchemaCoercercoerce in coercer.ts, where attacker-controlled keys from untrusted input are processed before validation by the SmartCoercionPlugin. Wh...

@c15t/backend (>=1.5.0-canary-20250902132553, <=1.8.6), @c15t/cli (>=1.5.0-canary-20250902132553, <=1.9.0) +14 more potentially affected by CVE-2026-103036 via @orpc/json-schema (>=1.7.0, <=1.14.8)

@orpc/json-schema NPM version =1.7.0, =1.5.0-canary-20250902132553, =1.5.0-canary-20250902132553, =1.5.0-canary-20250902132553, =1.5.0-canary-20250902132553, =1.5.0-canary-20250902132553, =1.5.0-canary-20250902132553, =0.1.1, =0.1.0, =0.4.0, =0.4.0, =1.7.0, =1.5.0-canary-20250902132553, =1.9.0 -...

CVE-2026-103036

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

CVE-2026-103036

The oRPC tool (specifically the @orpc/json-schema SmartCoercionPlugin ) is vulnerable to a prototype injection issue in versions prior to 1.14.9 . The root cause is the use of JsonSchemaCoercer to resolve schema.properties entries through the prototype chain. A remote client can supply __proto__ ...

EUVD-2026-91791

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...