EUVD-2026-62599

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...

CVE-2026-62681 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...

swr-europe.de Cross Site Scripting vulnerability OBB-3053448

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SWR-Radio - External URLs, SD-card access, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application SWR-Radio published at the 'play' market has multiple vulnerabilities...

SWR Mediathek - MIT license, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application SWR Mediathek published at the 'play' market has multiple vulnerabilities...

PT-2009-2741 · Apache · Apache Jackrabbit

Name of the Vulnerable Software and Affected Versions: Apache Jackrabbit versions prior to 1.5.2 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via the ...