CVE-2026-108379

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parsefixed inserts a fixed type's namespace value between quotes inside a generated types.confix...

CVE-2026-108381

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a...

CVE-2026-108376

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.getfielddefault inserts a schema-controlled referenced record name into the callable...

EUVD-2026-99220

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

CVE-2026-95631

Adobe Commerce is affected by an Improper Input Validation vulnerability (CWE-20) that could allow an attacker with high privileges to achieve arbitrary code execution in the context of the current user. The vulnerability does not require user interaction to exploit, and its scope is changed. No ...

CVE-2026-95631 Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

CVE-2026-103849 Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation ...

CVE-2026-103849

Adobe Commerce is impacted by an Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) vulnerability. This flaw could allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user, potentially leading to elevated access or full...

CVE-2026-103849 Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation ...

CVE-2026-92464

Adobe Commerce is affected by an Improper Input Validation vulnerability (CWE-20) that could lead to arbitrary code execution in the context of the current user. An attacker with high privileges can exploit this issue without user interaction. No specific affected versions, root cause components,...

CVE-2026-92464 Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

CVE-2026-92464

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

CVE-2026-92909 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

CVE-2026-92909

Adobe Commerce is affected by an Incorrect Authorization vulnerability (CWE-863 ) that could lead to arbitrary code execution in the context of the current user. An attacker could exploit this issue without requiring any user interaction. While the vulnerability details are provided, no specific ...

EUVD-2026-99212

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

CVE-2026-108384 dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bare string

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parsefixed interpolates a fixed type's aliases value directly into a generated types.confixed...

EUVD-2026-98981

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parsefixed interpolates a fixed type's aliases value directly into a generated types.confixed...

CVE-2026-108384

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parsefixed interpolates a fixed type's aliases value directly into a generated types.confixed...

CVE-2026-108384 dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bare string

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parsefixed interpolates a fixed type's aliases value directly into a generated types.confixed...

CVE-2026-108384

The dataclasses-avroschema library (versions 0.38.0 through 0.70.5 ) contains a code injection vulnerability in the BaseGenerator.parse_fixed function. The root cause is the direct interpolation of a fixed type's aliases value into a generated types.confixed annotation. While lists are correctly ...