CVE-2026-12476

The Easy Digital Downloads plugin for WordPress (up to v3.6.9) is affected by Arbitrary File Upload due to insufficient validation in edd_do_ajax_import_file_upload(). The function relies on the client-provided $_FILES['edd-import-file']['type'] against a CSV allow-list and uses raw move_uploaded...

Malicious code in @types-beta/sdk (npm)

The npm package @types-beta/sdk is a supply-chain dropper that impersonates the trusted @types DefinitelyTyped namespace to look like a routine type-definition dependency. It bundles a Windows executable vendor/nanocache.exe and launches it as an import-time side effect: dist/index.js calls init ...

CVE-2026-6336: Incorrect Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check...

PT-2026-65890

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 16.6 through 19.0.4 GitLab CE/EE versions 19.1 through 19.1.2 GitLab CE/EE versions 19.2 through 19.2.0 Description A missing authorization check allows an unauthorized user to view project import source information under...

NewStart CGSL MAIN 6.06 : containerd.io Vulnerability (NS-SA-2026-0060)

The remote NewStart CGSL host, running version MAIN 6.06, has containerd.io packages installed that are affected by a vulnerability: - containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User se...

CVE-2026-55415

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema...

CVE-2026-54653

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.17.0 until 0.60.2, datamodel-code-generator preserves attacker-controlled defaultfactory values in...

CVE-2026-54621

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...

Improper Neutralization of Special Elements Used in a Template Engine

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the comment field in the --extra-template-data. An attacker can execute arbitrary Python code during import...

GHSA-386Q-5HP3-95M9 `datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field

Summary datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, or XSD schema. When a property carries a "defaultfactory" key, its value is interpolated verbatim — as a raw Python expressi...

`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data

Summary When the Pydantic v2 output mode is in use, datamodel-code-generator reads a validators array from each model entry in the --extra-template-data file and synthesises a Pydantic @fieldvalidator... decorator from each entry. The field names and the validator mode are interpolated into the...

EUVD-2026-50075

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in...

CVE-2026-54656

CVE-2026-54656 affects datamodel-code-generator (0.52.1–0.60.2). The issue arises when validators are interpolated from --extra-template-data into @field_validator decorators via _process_validators in src/datamodel_code_generator/model/pydantic_v2/base_model.py, enabling Python code execution up...

CVE-2026-54656 `datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in...

CVE-2026-54656 `datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in...

CVE-2026-54656 `datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in...

datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements

Summary A malicious input schema OpenAPI / JSON Schema can execute arbitrary Python code on the machine that imports the generated model. The x-python-import and customTypePath schema extensions flow, unsanitized, into the import statements datamodel-code-generator emits. A newline embedded in th...

GHSA-5578-W22F-PFX9 datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements

Summary A malicious input schema OpenAPI / JSON Schema can execute arbitrary Python code on the machine that imports the generated model. The x-python-import and customTypePath schema extensions flow, unsanitized, into the import statements datamodel-code-generator emits. A newline embedded in th...

CVE-2026-55415 datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema...

CVE-2026-55415 datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema...