CVE-2026-73651

creationtimestamp| type| source ---|---|--- 2026-08-13 20:35:04+00:00| published-proof-of-concept| https://github.com/typeorm/typeorm/security/advisories/GHSA-2rp8-mm9q-fp49...

CVE-2026-69117

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

CVE-2026-69117 NetBox 4.5.8 ORM Injection via WritableNestedSerializer

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

CVE-2026-69117

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

EUVD-2026-56860

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

CVE-2026-69117 NetBox 4.5.8 ORM Injection via WritableNestedSerializer

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

CVE-2026-69117

CVE-2026-69117 : NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH re...

CVE-2026-69117 NetBox 4.5.8 ORM Injection via WritableNestedSerializer

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

CVE-2026-69117: Authorization Bypass Through User-Controlled Key

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

PT-2026-70842

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

django-avishan (>=0.2.42, <=0.3.23), django-nameko-standalone (2.0.1) +6 more potentially affected by CVE-2026-15307 via django (3.0.7)

django PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-avishan =0.2.42, =0.5.6, =1.7.4, =1.8.0a1 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

django-avishan (>=0.2.42, <=0.3.23), django-nameko-standalone (2.0.1) +6 more potentially affected by CVE-2026-15830 via django (3.0.7)

django PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-avishan =0.2.42, =0.5.6, =1.7.4, =1.8.0a1 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...

django-avishan (>=0.2.42, <=0.3.23), django-nameko-standalone (2.0.1) +6 more potentially affected by CVE-2026-15830 via django (3.0.7)

django PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-avishan =0.2.42, =0.5.6, =1.7.4, =1.8.0a1 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...

CLSA-2026-1777509602 TuxCare security update for doctrine/orm (1 CVE)

TuxCare rebuilt doctrine/orm to address 1 CVE. Fixed in 2.8.3-p1+tuxcare...

PT-2026-74649

TuxCare rebuilt doctrine/orm to address 1 CVE. Fixed in 2.8.3-p1+tuxcare...

@atlantjs/backend (>=11.0.11, <=11.0.79), @atlantjs/database (>=2.0.0, <=2.1.32) +4 more potentially affected by unknown CVE via typeorm (1.0.0)

typeorm NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on typeorm and may be impacted: - @atlantjs/backend =11.0.11, =2.0.0, =0.48.60, =2.1.5, =1.1.43, =1.1.45 Source cves: unknown CVE Source advisory: SNYK:JS-TYPEORM-18170276...

@142vip/midway (>=0.1.6-alpha.9, <=0.1.6-alpha.12), @142vip/nest-starter (>=0.0.1-alpha.1, <=0.0.1-alpha.13) +2838 more potentially affected by CVE-2026-73651 via typeorm (>=0.0.2-alpha.43, <=0.3.30)

typeorm NPM version =0.0.2-alpha.43, =0.1.6-alpha.9, =0.0.1-alpha.1, =0.0.1-alpha.1, =1.0.1, =3.3.4, =1.0.1, =0.0.1, =0.9.3, =1.0.0, =1.1.126, =1.0.0, =1.0.0, =1.0.14 - @actonate/mirkwood 0.10.1 and more Source cves: CVE-2026-73651 Source advisory: OSV:GHSA-2RP8-MM9Q-FP49...

pymilvus-orm (0.0.1), stlearn (>=0.1.3, <=0.1.6) potentially affected by CVE-2025-71176 via pytest (5.3.4)

pytest PYPI version 5.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - pymilvus-orm 0.0.1 - stlearn =0.1.3, =0.1.6 Source cves: CVE-2025-71176 Source advisory: OSV:PYSEC-2026-1845...

django-avishan (>=0.2.42, <=0.3.23), django-nameko-standalone (2.0.1) +6 more potentially affected by CVE-2026-53878 via django (3.0.7)

django PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-avishan =0.2.42, =0.5.6, =1.7.4, =1.8.0a1 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

CVE-2026-13766

DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. The default SQL builder, a SQL::Abstract subclass, sets bindtype in its constructor but never quotechar, so SQL::Abstract emits identifiers verbatim. Caller-supplied identifiers orderby, where-claus...