io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (0.12.0), org.kie.kogito:integration-tests-jobs-service-quarkus (>=1.30.0.final, <=1.32.0.final) +9 more potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (0.12.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.0.0) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.0.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.1.0) potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.1.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.2.0), org.kie.kogito:integration-tests-jobs-service-quarkus-knative-eventing (>=1.33.0.final, <=1.34.0.final) +15 more potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.2.0)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

io.quarkiverse.openapi.generator:quarkus-openapi-generator-deployment (1.2.1), org.kie.kogito:integration-tests-data-index-service-quarkus-devservice (1.42.0.final) +23 more potentially affected by CVE-2026-40180 via io.quarkiverse.openapi.generator:quarkus-openapi-generator (1.2.1)

io.quarkiverse.openapi.generator:quarkus-openapi-generator MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkiverse.openapi.generator:quarkus-openapi-generator and may be impacted: -...

GHSA-JX2W-VP7F-456Q quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class

Summary A path traversal vulnerability was discovered in the quarkus-openapi-generator extension Details The unzip method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is...

CVE-2026-4808 Gerador de Certificados – DevApps <= 1.3.6 - Authenticated (Administrator+) Arbitrary File Upload

The Gerador de Certificados – DevApps plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the moveUploadedFile function in all versions up to, and including, 1.3.6. This makes it possible for authenticated attackers, with Administrator-level access...

LanG -- a Governance-Aware Agentic AI Platform for Unified Security Operations

Modern Security Operations Centers struggle with alert fatigue, fragmented tooling, and limited cross-source event correlation. Challenges that current Security Information Event Management and Extended Detection and Response systems only partially address through fragmented tools. This paper...

CVE-2026-35166

A flaw was found in Hugo, a static site generator. This vulnerability arises from improper escaping of links and image links within the default markdown to HTML renderer. A remote attacker could exploit this by crafting malicious markdown content, potentially leading to information disclosure or...

Security Bulletin: IBM OpenAPI SDK Generator (Node.js) is affected by the Axios supply chain attack

Summary Due to an Axios supply chain attack, a fix for IBM Node.js SDK Core https://github.com/IBM/node-sdk-core was made available on April 2, 2026 21:03 UTC to mitigate the attack. If you used a previous version there is a possibility the affected Axios package could have been available on your...

CVE-2026-25726

Cloudreve is a self-hosted file management and sharing system. Prior to version 4.13.0, the application uses the weak pseudo-random number generator math/rand seeded with time.Now.UnixNano to generate critical security secrets, including the secretkey, and hashidsalt. These secrets are generated...

CVE-2026-22662

prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to perform server-side fetches of user-controlled inputImageUrl parameters. Attackers can exploit this vulnerability by sending POST requests...

[SECURITY] Fedora 42 Update: rust-1.94.1-1.fc42

Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. This package includes the Rust compiler and documentation generator...

Code Screenshot Generator MCP 操作系统命令注入漏洞

Code Screenshot Generator MCP is a code screenshot generation tool developed by Moussaab Badla. Versions of Code Screenshot Generator MCP prior to 0.1.0 contained a vulnerability related to operating system command injection, which stemmed from HTTP interfaces allowing for OS command injections...

EUVD-2026-18823

prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to perform server-side fetches of user-controlled inputImageUrl parameters. Attackers can exploit this vulnerability by sending POST requests...

CVE-2026-22662 prompts.chat Blind SSRF via media-generate

prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to perform server-side fetches of user-controlled inputImageUrl parameters. Attackers can exploit this vulnerability by sending POST requests...

CVE-2026-22662 prompts.chat Blind SSRF via media-generate

prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to perform server-side fetches of user-controlled inputImageUrl parameters. Attackers can exploit this vulnerability by sending POST requests...

CVE-2026-22662

CVE-2026-22662 : A blind SSRF exists in prompts.chat’s Wiro media generator, exploitable by authenticated users via POST to /api/media-generate with user-controlled inputImageUrl. The vulnerability permits server-side fetches to internal networks and services, allowing data exfiltration through t...

CVE-2026-22662 prompts.chat Blind SSRF via media-generate

prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to perform server-side fetches of user-controlled inputImageUrl parameters. Attackers can exploit this vulnerability by sending POST requests...

CVE-2026-25726 Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)

Cloudreve is a self-hosted file management and sharing system. Prior to version 4.13.0, the application uses the weak pseudo-random number generator math/rand seeded with time.Now.UnixNano to generate critical security secrets, including the secretkey, and hashidsalt. These secrets are generated...