504669 matches found
EUVD-2026-62601
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permi...
CVE-2026-71871 Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permi...
CVE-2026-71871
Orval (pre-8.21.0) emits unescaped ${...} or backtick strings from OpenAPI header-parameter defaults into a module-level template literal in generated zod schema code (packages/zod/src/index.ts function formatDefaultValue). Importing the generated module evaluates the attacker-controlled JavaScri...
CVE-2026-72716
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permit...
CVE-2026-72716 Orval: Import-time RCE via query-parameter default -> zod module-level template literal
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permit...
CVE-2026-62681 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...
EUVD-2026-62599
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...
CVE-2026-61536
A flaw was found in Banks, a tool for generating LLM prompts. This vulnerability allows a remote attacker to achieve arbitrary code execution by injecting a malicious tool definition into a template. The system improperly resolves the path specified in this definition, enabling the attacker to...
CVE-2026-71866 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object... schema without safe encoding. This permits attacker-controlled JavaScrip...
EUVD-2026-62596
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object... schema without safe encoding. This permits attacker-controlled JavaScrip...
CVE-2026-71866
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object... schema without safe encoding. This permits attacker-controlled JavaScrip...
CVE-2026-72449
A flaw was found in the Linux kernel's drm/amdkfd component. An unprivileged render-group user can exploit this vulnerability via /dev/kfd by repeatedly calling AMDKFDIOCCRIUOP. This leads to a use-after-free and double-free condition due to improper list handling during cleanup. Successful...
CVE-2026-74569
A flaw was found in the Linux kernel's netfilter Session Initiation Protocol SIP connection tracking module nfconntracksip. A remote attacker could send specially crafted SIP messages that cause an integer overflow during Network Address Translation NAT rewrite delta calculations. This overflow...
MINI-WR2R-V8PH-C7QX
Bulletin has no description...
CVE-2026-72530
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system...
CVE-2026-72529
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function...
CVE-2026-64832
A flaw was found in FFmpeg, specifically within the NVIDIA NVDEC hardware decoder. A remote attacker could exploit this double-free vulnerability by providing a specially crafted video file. This can lead to memory corruption, potentially allowing for arbitrary code execution or causing a denial ...
CVE-2026-49441
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of processfilesfromworker in framework/wazuh/core/cluster/master.py trusts a peer-controlled filepath key from filesmetadata.json. The...
CVE-2026-44901
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge in framework/wazuh/core/results.py trusts the sortcasting field in a cluster worker's JSON response. During a distributed API merge...