331 matches found
CVE-2026-119028 oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values
oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in...
EUVD-2026-112756
oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in...
CVE-2026-119028
The oapi-codegen tool (versions 2.0.0 before 2.8.1 ) is vulnerable to a code injection vulnerability (CWE-94). An attacker who controls an OpenAPI document can supply non-literal enum entries within integer, number, or boolean schemas. By crafting a specific enum entry, the attacker can premature...
OAPI Codegen code injection vulnerability
Versions 2.0.0 through 2.8.1 of oapi-codegen contain a code injection vulnerability. This vulnerability stems from improper handling of non-literal enum entries in OpenAPI documents. Attackers can craft such entries to disable the const block within constants.tmpl and inject func init, thereby...
CVE-2026-119139: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that…
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export...
PT-2026-132102
oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in...
Bytecode Alliance wasmtime improper exception handling vulnerability
The Bytecode Alliance Wasmtime versions prior to 46.0.0 through 48.0.6 and 49.0.0 through 49.0.3 contain an improper exception handling vulnerability. This vulnerability stems from a legacy assertion within component::Func::call that disallows guest exports when asynchronous ABI options are used...
PT-2026-132370
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export...
CVE-2026-117534
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or...
CVE-2026-117534
REDAXO versions prior to 5.21.3 are vulnerable to a cross-site request forgery (CSRF) vulnerability within the structure/history plugin . The root cause is the use of unvalidated GET requests to perform sensitive actions. An attacker can lure authenticated backend users to a malicious page that t...
EUVD-2026-110799
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or...
CVE-2026-117534 REDAXO before 5.21.3 CSRF in Article History Plugin
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or...
CVE-2026-117534 REDAXO before 5.21.3 CSRF in Article History Plugin
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or...
PT-2026-126369
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex history...
REDAXO CMS core cross-site request forgery vulnerability
REDAXO CMS versions prior to core 5.21.3 contain a cross-site request forgery vulnerability. This flaw stems from the structure/history plugin’s failure to validate GET requests, making it susceptible to such attacks. It could allow attackers to trick logged-in users into triggering func=clearall...
PT-2026-126371
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page users/users because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC UPDATE does not require it. Attackers can lure a logged-in...
DEBIAN-CVE-2026-98817
In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add better pmruntime error handling in func probe Add a common error path in probe that balances the runtime PM reference...
UBUNTU-CVE-2026-98817
In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add better pmruntime error handling in func probe Add a common error path in probe that balances the runtime PM reference...
EUVD-2026-103902
In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add better pmruntime error handling in func probe Add a common error path in probe that balances the runtime PM reference...
CVE-2026-98817
The Linux kernel addressed an issue within the ASoC: SDCA component related to pm_runtime error handling. The vulnerability involved a missing common error path during the func probe process, which prevented the proper balancing of the runtime PM reference . The fix ensures that the reference is ...