datamodel-code-generator (>=0.1.0, <=0.2.4), lambdantic (>=0.0.1, <=0.0.4) potentially affected by CVE-2024-3772 via pydantic (0.32.0)

pydantic PYPI version 0.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on pydantic and may be impacted: - datamodel-code-generator =0.1.0, =0.0.1, =0.0.4 Source cves: CVE-2024-3772 Source advisory: OSV:PYSEC-2026-1812...

GHSA-8444-4FHQ-FXPQ PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default

Summary CVE-2026-44338 GHSA-6rmh-7xcm-cpxj documents that PraisonAI ships a code-generator praisonai.deploy.api.generateapiservercode that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart praisonai deploy --type api get a server that: -...

@absa-subatomic/openshift-api (>=0.0.1, <=0.0.2), @atomist-seeds/automation-client (>=1.0.0-atomist-update-1.0.0-M.5a-1538147067873.20180928150441, <=1.0.0-master.20180928151025) +40 more potentially affected by unknown CVE via graphql-code-generator (>=0.5.5, <=0.17.0)

graphql-code-generator NPM version =0.5.5, =0.0.1, =1.0.0-atomist-update-1.0.0-M.5a-1538147067873.20180928150441, =1.0.0-atomist-update-1.0.0-M.5a-1538146868055.20180928150114, =1.0.0-atomist-update-1.0.0-M.5a-1538147121196.20180928150530, =0.1.0-master.20181019173228,...

WS-2019-0068

All versions of graphql-code-generator have an Insecure Default Configuration. The packages sets NODETLSREJECTUNAUTHORIZED to 0, disabling certificate verification for the entire project...

EUVD-2022-55980

WordPress Contact Form Builder 1.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting the formid parameter. Attackers can craft malicious URLs to codegenerator.php with script payloads in the formid parameter t...

CVE-2022-50959

WordPress Contact Form Builder 1.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting the formid parameter. Attackers can craft malicious URLs to codegenerator.php with script payloads in the formid parameter t...

CVE-2022-50959

CVE-2022-50959 affects WordPress Contact Form Builder 1.6.1. It is a reflected cross-site scripting vulnerability where an unauthenticated attacker can cause arbitrary JavaScript execution in a victim’s browser by injecting payloads via the form_id parameter, using crafted URLs to code_generator....

CVE-2022-50959 WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php

WordPress Contact Form Builder 1.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting the formid parameter. Attackers can craft malicious URLs to codegenerator.php with script payloads in the formid parameter t...

CVE-2022-50959 WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php

WordPress Contact Form Builder 1.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting the formid parameter. Attackers can craft malicious URLs to codegenerator.php with script payloads in the formid parameter t...

WordPress Plugin Contact Form Builder: Cross-site Script Vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

CVE-2026-41507 Remote Code Execution (RCE) via String Literal Injection into math-codegen

math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.parse is injected verbatim into a new Function body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the...

CVE-2026-41507

CVE-2026-41507 affects math-codegen. Prior to 0.4.3, string literals passed to cg.parse() are injected into a new Function() body without sanitization, enabling attacker-controlled input to execute arbitrary system commands and potentially achieve full RCE when user input reaches the parser. The ...

CVE-2026-41507 Remote Code Execution (RCE) via String Literal Injection into math-codegen

math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.parse is injected verbatim into a new Function body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the...

CVE-2026-30308

In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a...

CVE-2026-30308

In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a...

CVE-2026-30308

The HAI Build Code Generator , an AI-driven software requirement generation and management tool by Presidio INC, contains a design flaw in its automatic terminal command execution feature. The software offers an "Execute safe commands" option where a model determines which commands to execute aut...

CVE-2026-30308: Improper Control of Generation of Code

In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a...

CVE-2026-30308

In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a...

com.faendir.vaadin:jfreechart-flow (1.1.6), com.github.mcollovati.vertx:vaadin-flow-sockjs (0.2.0) +69 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (1.0.5)

com.vaadin:flow-server MAVEN version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.faendir.vaadin:jfreechart-flow 1.1.6 - com.github.mcollovati.vertx:vaadin-flow-sockjs 0.2.0 -...

com.github.mcollovati.vertx:vaadin-flow-sockjs (12.0.0), com.github.mcollovati.vertx:vertx-vaadin-flow (12.0.0) +28 more potentially affected by CVE-2026-2742 via com.vaadin:flow-server (1.2.5)

com.vaadin:flow-server MAVEN version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:flow-server and may be impacted: - com.github.mcollovati.vertx:vaadin-flow-sockjs 12.0.0 - com.github.mcollovati.vertx:vertx-vaadin-flow 12.0.0 -...