CVE-2026-63325 Redocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect`

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

CVE-2026-63325 Redocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect`

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

EUVD-2026-81012

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

CVE-2026-63325 Redocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect`

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

EUVD-2026-80815

Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud...

CVE-2026-27559

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

CVE-2026-27563 Command Injection via GET in /api/datastorage/data

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80246

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27561 Command Injection via GET in /api/iodd/config

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27561 Command Injection via GET in /api/iodd/config

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27561

CVE-2026-27561 is a command injection vulnerability in the /api/iodd/config endpoint. A high-privileged remote attacker can exploit it by sending a crafted GET request with admin credentials , enabling execution of commands with root privileges on the affected device. The CNA is CERT-VDE , which ...

EUVD-2026-80244

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27559 Command Injection via GET in /api/status/data

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

CVE-2026-27559 Command Injection via GET in /api/status/data

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

CVE-2026-27559

CVE-2026-27559 is a command injection vulnerability in the /api/status/data endpoint of a product managed by CERT VDE . A low-privileged remote attacker can send a crafted GET request with user credentials to execute commands with root privileges on the device. The assigned CVSS 3.1 score is 8.8 ...

EUVD-2026-80242

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

CVE-2026-92299 @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...

PT-2026-93911

Name of the Vulnerable Software and Affected Versions @redocly/respect-core versions prior to 2.33.0 @redocly/cli versions prior to 2.33.0 Description The respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

CVE-2026-92468: Authorization Bypass Through User-Controlled Key

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in POST /search/indexName and GET /agg/requestStat/indexName/routing path...

PT-2026-93585

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak occurs in the ASOC hdac hda component. The hdac hda dev probe function acquires an HDA link using snd hdac ext bus link get before registering the ASoC component. ...