PT-2026-34560

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.31.1 Description Kiota is an OpenAPI based HTTP Client code generator. A code-generation literal injection exists in multiple writer sinks, including serialization/deserialization keys, path/query parameter mappings,...

DeepGuard Secure Code Generation

Large Language Models LLMs for code generation can replicate insecure patterns from their training data. To mitigate this, a common strategy for security hardening is to fine-tune models using supervision derived from the final transformer layer. However, this design may suffer from a final-layer...

The vulnerability of the N8n automation platform, related to improper code generation management, allows a perpetrator to execute arbitrary code.

The vulnerability of the N8n automation platform for work processes is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE, related to improper code generation management, allows attackers to compromise the confidentiality of protected information.

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE is related to improper management of code generation. Exploiting this vulnerability can allow a malicious actor, operating remotely, to compromise the confidentiality of protected information...

quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class

Summary A path traversal vulnerability was discovered in the quarkus-openapi-generator extension Details The unzip method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is...

CVE-2026-27140 Code execution vulnerability in SWIG code generation in cmd/go

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass...

CVE-2026-27140 Code execution vulnerability in SWIG code generation in cmd/go

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass...

CVE-2026-27140 Code execution vulnerability in SWIG code generation in cmd/go

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass...

CVE-2026-27140

The Go programming language (golang) is vulnerable to arbitrary code execution at build time due to a trust layer bypass in the cmd/go toolchain. The root cause involves SWIG file names containing 'cgo' combined with well-crafted payloads, which can lead to code smuggling . This vulnerability aff...

GO-2026-4871 Code execution vulnerability in SWIG code generation in cmd/go

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass...

Inside an AI‑enabled device code phishing campaign

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Indicators of compromise IOC 4. References 5. Learn more Microsoft Defender Security Research has observed a widespread phishing campaign leveraging the Device Code Authentication flow to compromise organizational...

Inside an AI‑enabled device code phishing campaign

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Indicators of compromise IOC 4. References 5. Learn more Microsoft Defender Security Research has observed a widespread phishing campaign leveraging the device code authentication flow to compromise organizational...

SecPI: Secure Code Generation with Reasoning Models Via Security Reasoning Internalization

Reasoning language models RLMs are increasingly used in programming. Yet, even state-of-the-art RLMs frequently introduce critical security vulnerabilities in generated code. Prior training-based approaches for secure code generation face a critical limitation that prevents their direct applicati...

[SECURITY] Fedora 42 Update: cmake-3.31.11-1.fc42

CMake is used to control the software compilation process using simple platform and compiler independent configuration files. CMake generates native makefiles and workspaces that can be used in the compiler environment of your choice. CMake is quite sophisticated: it is possible to support comple...

The vulnerability of the Drupal CMS system’s kernel, related to improper code generation, allows attackers to execute arbitrary code.

The vulnerability of the Drupal CMS system’s kernel is related to improper code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from bpf not performing constant obfuscation on the PROBEMEM32 storage mechanism. This vulnerability m...

The vulnerability of the SandboxJS library, related to improper code generation management, allows a violator to escape from the isolated programming environment.

The vulnerability of the SandboxJS library is related to improper handling of code generation. Exploiting this vulnerability can allow a remote attacker to escape from an isolated programming environment...

The vulnerability of the _unzip_iter() function in the Natural Language Processing and symbolic processing library package NLTK allows a hacker to execute arbitrary code.

The vulnerability of the unzipiter function in the Natural Language Processing and statistical processing library package NLTK is related to improper code generation. Exploiting this vulnerability may allow a remote attacker to execute arbitrary code...

ROS-20260401-73-0044

Vulnerability in salt related to incorrect code generation control. Exploitation of the vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers allows attackers to execute arbitrary code.

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTML page from a remote location...