BFScan

BFScan Herramienta para el procesamiento inicial de aplicaciones APK / XAPK / APKM / DEX / JAR / WAR. Busca cadenas en el código fuente y los recursos que parezcan URI, rutas o secretos Genera solicitudes HTTP sin procesar y especificaciones OpenAPI basadas en archivos de configuración, anotacion...

EUVD-2026-68729

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default allow-external-refs: true. When an action runs on a pull request whose spec i...

CVE-2026-53507 oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default allow-external-refs: true. When an action runs on a pull request whose spec i...

PT-2026-83968

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default allow-external-refs: true. When an action runs on a pull request whose spec i...

CVE-2026-53507: Exposure of Sensitive Information to an Unauthorized Actor

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default allow-external-refs: true. When an action runs on a pull request whose spec i...

EUVD-2026-62955

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer REST A...

CVE-2026-76390 Information Disclosure through Splunk Web in Cisco Talos Intelligence for Enterprise Security Cloud

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer REST A...

CVE-2026-71868

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

PT-2026-78545

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description An issue exists where unescaped backticks in an OpenAPI path are emitted into request URL template literals for axios, fetch, react-query, and SWR clients without safe encoding. This allows...

CVE-2026-54663

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

CVE-2026-54661

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...

swagger-typescript-api vulnerable to code injection via unescaped enum string values

Summary swagger-typescript-api interpolates components.schemas..enumi string values into the body of generated TypeScript enum declarations without escaping. A malicious enum value can close the enclosing string literal, terminate the enum body, and inject a bare-block IIFE that executes at modul...

CVE-2026-54664 swagger-typescript-api vulnerable to code injection via unescaped enum string values

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas..enumi values to Ts.StringValue in src/configuration.ts without escaping before...

CVE-2026-54664

swagger-typescript-api prior to 13.12.2 is vulnerable: enum string values are inserted into generated TypeScript enums without escaping, enabling attacker-controlled OpenAPI specs to inject code that runs on module import. Root cause is Ts.StringValue wrapping values without escaping, propagated ...

CVE-2026-54661 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...

swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

Summary swagger-typescript-api walks every $ref value in the input OpenAPI spec and, for any $ref whose target is an https:// URL, issues an HTTP GET to that URL during generation warmUpRemoteSchemasCache. The only URL filter is a regex that matches ^https?:// — there is no private-IP allowlist, ...

CVE-2026-54663

swagger-typescript-api before v13.12.2 allows SSRF during code generation via warmUpRemoteSchemasCache: external $ref URLs are fetched with no private IP, DNS rebinding, redirect, or same-origin checks, enabling attacker-controlled OpenAPI specs to trigger requests to internal or link-local servi...

CVE-2026-54663 swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

CVE-2026-54663 swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

CVE-2026-54662

Swagger-typescript-api vulnerable to code injection via unescaped servers[0].url in the fetch HTTP client template (CVE-2026-54662). Prior to 13.12.2, createApiConfig copies servers[0].url into apiConfig.baseUrl and fetch-http-client.ejs interpolates it into the generated HttpClient baseUrl witho...