Lucene search
+L

996 matches found

Kitploit
Kitploit
added 2026/09/17 12:58 a.m.10 views

CVE-2026-23947-PoC

Walkthrough: CVE-2026-23947 - Orval Arbitrary Code Execution This walkthrough demonstrates how an untrusted OpenAPI specification can exploit Orval to inject arbitrary code into generated clients via the x-enumDescriptions and x-enumNames fields. Prerequisites Node.js v20 or v22 npm Setup 1. Crea...

9.8CVSS6AI score0.00845EPSS
SaveExploits1
Cvelist
Cvelist
added 2026/09/16 7:09 p.m.34 views

CVE-2026-63225 Redocly CLI: Path traversal when using `split` command

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target...

4.4CVSS0.00172EPSS
SaveExploits0References7
Kitploit
Kitploit
added 2026/09/16 1:36 p.m.10 views

CVE-2026-22785

CVE-2026-22785 Reproduction Tutorial Vulnerability Overview CVE : CVE-2026-22785 Impact : orval = 7.18.0 CVSS : 9.3 CRITICAL Type : Code Injection Vulnerability Principle orval 7.18.0 directly concatenates the summary field from the OpenAPI specification into the template when generating MCP serv...

9.8CVSS6.1AI score0.0079EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/16 11:00 a.m.12 views

CVE-2026-33331

CVE-2026-33331 — Stored XSS in oRPC OpenAPI Reference Plugin Proof-of-concept lab for stored XSS in orpc's OpenAPI documentation generation Purpose oRPC builds API docs pages from an OpenAPI spec. Before v1.13.9 it dumped the spec directly into a tag using JSON.stringify with no HTML encoding. An...

8.2CVSS5.9AI score0.00288EPSS
SaveExploits1References2
OSV
OSV
added 2026/09/15 3:13 p.m.6 views

CVE-2026-59973 mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec forwards untrusted OpenAPI url and spec inputs and...

8.5CVSS5.7AI score
SaveExploits0References9
Kitploit
Kitploit
added 2026/09/15 2:42 a.m.11 views

CVE-2026-71203-PoC

CVE-2026-71203 — changedetection.io: Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema Product: dgtlmoon/changedetection.io — v0.55.7 File: changedetectionio/api/Spec.py CWE: CWE-306 — Missing Authentication for Critical Function CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A...

5.3CVSS5.8AI score0.00256EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/15 1:20 a.m.35 views

CVE-2026-91774 Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

5.3CVSS0.00199EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/15 1:20 a.m.13 views

CVE-2026-91774

Yao through v1.0.0-rc22 suffers from a missing authorization check on the OpenAPI GET /user/teams/:id endpoint. The endpoint authenticates the caller but fails to verify team membership, allowing any logged-in user who knows a team identifier to retrieve full team records, including name, descrip...

5.3CVSS5.7AI score0.00199EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/15 1:20 a.m.8 views

CVE-2026-91774 Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

5.3CVSS5.7AI score
SaveExploits0References7
OSV
OSV
added 2026/09/11 10:02 p.m.6 views

GHSA-65H7-9WRW-629C FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

Summary The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external $ref dereferencing, but the latest patched dependency mcp-from-openapi 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname...

8.5CVSS5.8AI score0.00376EPSS
SaveExploits0References2
Patchstack
Patchstack
added 2026/09/11 10:02 p.m.7 views

NPM: FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

NPM: FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix vulnerability discovered by ? in WordPress Npm mcp-from-openapi versions = 2.3.0, 2.5.0...

8.5CVSS5.7AI score0.00376EPSS
SaveExploits0References2Affected Software1
Github Security Blog
Github Security Blog
added 2026/09/11 10:02 p.m.16 views

FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

Summary The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external $ref dereferencing, but the latest patched dependency mcp-from-openapi 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname...

8.5CVSS5.9AI score0.00376EPSS
SaveExploits1References2Affected Software3
Patchstack
Patchstack
added 2026/09/11 10:02 p.m.8 views

NPM: FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

NPM: FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix vulnerability discovered by ? in WordPress Npm frontmcp versions = 1.2.1, 1.5.0...

8.5CVSS5.7AI score0.00376EPSS
SaveExploits0References2Affected Software1
Positive Technologies
Positive Technologies
added 2026/09/11 12:00 a.m.17 views

PT-2026-90548

Summary The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external $ref dereferencing, but the latest patched dependency mcp-from-openapi 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname...

8.5CVSS5.9AI score0.00376EPSS
SaveExploits0References12
RedhatCVE
RedhatCVE
added 2026/09/09 3:53 p.m.12 views

CVE-2026-77354

A flaw was found in kin-openapi, a Go project for handling OpenAPI files. An unauthenticated client can exploit this vulnerability by sending a specially crafted query with a large index in a deepObject query parameter. This forces the application to allocate multi-gigabyte memory, leading to an...

8.7CVSS7.1AI score0.00302EPSS
SaveExploits0References7
NVD
NVD
added 2026/09/08 11:17 p.m.6 views

CVE-2026-53639

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...

6.3CVSS0.00543EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/09/08 9:22 p.m.7 views

CVE-2026-76905

A flaw was found in kin-openapi, a Go project for handling OpenAPI files. An unauthenticated client can exploit this vulnerability by sending a malformed non-string scalar field in a multipart/form-data request body. This can cause applications that render validation errors through specific...

7.5CVSS7.1AI score0.00421EPSS
SaveExploits0References6
RedhatCVE
RedhatCVE
added 2026/09/08 9:22 p.m.6 views

CVE-2026-73502

A flaw was found in kin-openapi. An unauthenticated remote attacker can trigger a null-pointer dereference in the openapi3filter.ValidateRequest function. This occurs when validating a request against a content parameter whose application/json media type has no schema. Successful exploitation lea...

5.3CVSS5.7AI score0.00451EPSS
SaveExploits0References6
NVD
NVD
added 2026/09/08 6:20 p.m.7 views

CVE-2026-72923

In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in Microsoft.OpenApi.Readers prior to 1.6.30, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML...

7.5CVSS0.012EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/08 5:12 p.m.18 views

CVE-2026-72923

Microsoft.OpenApi.YamlReader (versions 2.0.0-preview.11 through 2.12.0 and 3.0.0 through 3.10.0) and Microsoft.OpenApi.Readers (prior to 1.6.30) are vulnerable to a denial of service via YAML alias expansion. The root cause lies in how SharpYaml represents aliases as shared nodes in a directed ac...

7.5CVSS5.7AI score0.012EPSS
SaveExploits0References1
Rows per page
Query Builder