GHSA-2W86-XFRC-G85R Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator

Summary orval, when generating MSW mocks output.mock: true, emits each schema property name as a single-quoted object key in the mock factory WITHOUT escaping the single quote. A ' in a property name closes the key and lands in object-literal context, where an injected computed property key expr ...

Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator

Summary orval, when generating MSW mocks output.mock: true, emits each schema property name as a single-quoted object key in the mock factory WITHOUT escaping the single quote. A ' in a property name closes the key and lands in object-literal context, where an injected computed property key expr ...

Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

Summary orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key...

EUVD-2026-70653

R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via stri...

Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

Summary orval's zod client emits each header parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the header parameter name closes the key and lands in object-literal context, where an injected computed property k...

CVE-2026-84768

creationtimestamp| type| source ---|---|--- 2026-09-03 18:07:59+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mun264regj2w 2026-09-03 19:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mun53d4esm2w...

EUVD-2026-44774

Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match...

EUVD-2026-70520

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a GitRepo resource can cause the Fleet...

CVE-2026-84966

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intende...

CVE-2026-71404 Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole

A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable authz.management.cattle.io/cr-name annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could...

CVE-2026-71404 Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole

A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable authz.management.cattle.io/cr-name annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could...

grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name

A flaw in Grafana allows authenticated 'Editor' users to inject malicious scripts into a table panel's field names. Viewing the compromised dashboard executes the script in the victim's browser, risking data theft or client-side attacks...

grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name

A flaw in Grafana allows authenticated 'Editor' users to inject malicious scripts into a table panel's field names. Viewing the compromised dashboard executes the script in the victim's browser, risking data theft or client-side attacks...

CVE-2026-81521

A flaw was found in the MongoDB Go Driver. The Client.BulkWrite operation does not properly validate database names, allowing a specially crafted name with reserved characters to redirect write operations. This vulnerability could enable an attacker to modify or corrupt data in unintended databas...

CVE-2023-51214

creationtimestamp| type| source ---|---|--- 2026-09-03 03:00:05+00:00| seen| Telegram/NJgwL7B1ASSbdk2T8OqFuHqujkni1MAsUBxYkwSwj99SobY 2026-09-04 00:01:02+00:00| published-proof-of-concept| Telegram/NJgwL7B1ASSbdk2T8OqFuHqujkni1MAsUBxYkwSwj99SobY...

SUSE CVE-2026-82251

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state and open functions to repositories outside .git/modules...

CVE-2026-75036: Server-Side Request Forgery (SSRF)

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a GitRepo resource can cause the Fleet...

CVE-2026-82526: Improper Neutralization of Special Elements used in an SQL Command

R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via stri...

PT-2026-85064

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a GitRepo resource can cause the Fleet...

CVE-2026-71404: Authorization Bypass Through User-Controlled Key

A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable authz.management.cattle.io/cr-name annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could...