1653 matches found
CVE-2026-62680
In Orval versions before 8.22.0, the affected code in packages/orval/src/import-specs.ts loads external $ref values without any allowlist or directory confinement. Processing a malicious OpenAPI spec can trigger outbound requests to attacker-chosen or internal HTTP services, read absolute or out-...
ROS-20260819-73-0036
The vulnerability in Vim is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ROS-20260819-73-0035
The vulnerability in Vim is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ROS-20260819-73-0033
The vulnerability in Vim is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ROS-20260819-73-0037
The vulnerability in Vim is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
EUVD-2026-60308
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format outputformat='python' and outputformat='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the...
CVE-2026-73851 Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...
CVE-2026-65804
Improper control of generation of code 'code injection' in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...
The vulnerability of the dedoc/scramble package for the Laravel PHP framework allows a hacker to execute arbitrary code.
The vulnerability of the dedoc/scramble package for the Laravel PHP framework is related to incorrect code generation practices. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
EUVD-2026-51534
Improper Control of Generation of Code 'Code Injection' vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection. This issue affects Logsign SIEM: before 6.4.108...
The vulnerability of the s:stepmatch() function in the Vim text editor, which allows a hacker to execute arbitrary code.
The vulnerability of the s:stepmatch function in the Vim text editor is related to improper code generation. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...
CVE-2026-18140
Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service process abort via stack exhaustion via...
CVE-2026-18245
The CVE-2026-18245 entry concerns Amazon @aws-amplify/codegen-ui-react before 2.20.6, where the incomplete fix for CVE-2025-4318 leaves input validation insufficient. This may allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments,...
PT-2026-66564
Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...
GHSA-954P-556P-R752 datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)
Summary JSON-Schema $ref values pointing at HTTP or HTTPS URLs are silently dereferenced by datamodel-code-generator with no IP/host validation, no scheme allow-list, and redirects followed unconditionally. The --allow-remote-refs gate added in 0.56.0 defaults to None, which only emits a...
EUVD-2026-49567
Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...
BIT-DOTNET-2026-50650 .NET Framework Elevation of Privilege Vulnerability
Improper control of generation of code 'code injection' in .NET Framework allows an unauthorized attacker to elevate privileges locally...
ROS-20260727-73-0012
A vulnerability in the message broker administration console of the Apache ActiveMQ software platform is related to flaws in the code generation control mechanism. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary code...