CVE-2026-119027

oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers.x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init that executes wh...

CVE-2026-119028 oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in...

CVE-2026-119028

The oapi-codegen tool (versions 2.0.0 before 2.8.1 ) is vulnerable to a code injection vulnerability (CWE-94). An attacker who controls an OpenAPI document can supply non-literal enum entries within integer, number, or boolean schemas. By crafting a specific enum entry, the attacker can premature...

CVE-2026-119027 oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension

oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers.x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init that executes wh...

CVE-2026-119027 oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension

oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers.x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init that executes wh...

CVE-2026-119028 oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in...

CVE-2026-43284

🚨 CVE-2026-43284 — Dirty Frag 🚨 Universal Linux Kernel Local Privilege Escalation Overview Field| Detail ---|--- CVE| CVE-2026-43284 xfrm/ESP + CVE-2026-43500 RxRPC Nickname| Dirty Frag CVSS| 7.8 HIGH Type| Local Privilege Escalation LPE Introduced| Linux kernel 4.10 2017, commit cac2661c53f3...

CVE-2017-1000117

CVE-2017-1000117 Malicious actors can craft "ssh://…" links to trick victims into accessing the malicious link when executing programs, thereby achieving command execution. This link can be placed in the .gitmodules file of a git project, so that when a victim performs git clone...

26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories

26,400 credentials that developers left in public code on Gitee , a Chinese code-hosting service, still worked when a researcher tested them. Anyone who copied one from that code could have used it. Independent researcher Ben Zimmermann found them by scanning 7.25 million public Gitee repositorie...

agentic-ioc-scanner

agentic-ioc-scanner IOC scanner for agentic AI coding tools — detects Mini Shai-Hulud, Gemini CLI RCE, Cursor CVE-2026-26268, and DPRK PromptMink. A detection kit for compromise of agentic AI coding assistants Claude Code, Gemini CLI, Cursor and the dependencies they pull into your repos. Eleven...

CVE-2026-115821 NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters

The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingfirstname, billinglastname' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-115821

The NewsmanApp plugin for WordPress (versions ≤ 3.7.29 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'billing_first_name' and 'billing_last_name' parameters. This flaw allows unauthenticated attackers to inject ...

CVE-2026-115821 NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters

The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingfirstname, billinglastname' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-112749

The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingfirstname, billinglastname' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-115821 NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters

The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingfirstname, billinglastname' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

crml

CRML — Cyber Risk Modeling Language Status: Draft. This project is under heavy development and may change without notice. We welcome input, issues, and contributions. ⚠️ WARNING This codebase is currently being developed on the crml-dev-1.3 branch. For the latest work-in-progress and source of...

CVE-2026-119025

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $... subexpressions in URLs, such as OAuth authorizationendpoint values from malicious MCP servers, which...

CVE-2026-119025 open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $... subexpressions in URLs, such as OAuth authorizationendpoint values from malicious MCP servers, which...

CVE-2026-119025

The open software (versions 7.2.0 before 11.0.0 ) is vulnerable to an OS command injection on Windows and WSL environments. The root cause is that the index.js component passes unescaped URLs to powershell -EncodedCommand, allowing attackers to execute arbitrary PowerShell code by embedding $(......

EUVD-2026-112744

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $... subexpressions in URLs, such as OAuth authorizationendpoint values from malicious MCP servers, which...