CVE-2026-54659

Pagy (Ruby gem) contains a vulnerability in the I18n locale handling prior to 43.5.6: Pagy::I18n.locale= stores locale values verbatim and later uses them as .yml path components, enabling untrusted params[:locale] values with absolute paths or ../ sequences to probe file existence/readability of...

CVE-2026-54658 @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closin...

CVE-2026-54621

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...

CVE-2026-47219 find-my-way is Vulnerable to DDoS with HTTP2

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup function passes req.method into...

CVE-2026-47219

CVE-2026-47219 : The vulnerability affects the find-my-way HTTP router. Versions before 9.7.0 are susceptible to remotely triggerable DoS when used with Node's HTTP/2 server. The issue arises because lookup() passes req.method to find(), and find() indexes this.trees[method]. Since this.trees is ...

CVE-2026-54653

The CVE affects the datamodel-code-generator project. From versions 0.17.0 through 0.60.2, the tool could preserve attacker-controlled default_factory values in JsonSchemaObject.init/get_field_extras, emitting them into Field(default_factory=...) and enabling Python expression execution when the ...

CVE-2026-55391 datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodelcodegenerator/http.py through...

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

Summary datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A description on a Union type, written in the regular-string form "..." with a literal \r escape, is rendered into a Python comment by a Jinja2 filter that...

CVE-2026-54654 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

EUVD-2026-44800

NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass...

CVE-2026-59942

Dompdf (PHP HTML-to-PDF library) versions before 3.16 are vulnerable to a DoS via resource exhaustion. A crafted HTML string with a high-entropy, oversized image (e.g., 30000x30000) bypasses dimension checks and triggers heavy bitmap processing during rendering, causing 100% CPU usage and memory ...

CVE-2026-49447

Cosmos-Server 0.22.18 reportedly exposes constellation device metadata via GET /cosmos/api/constellation/public-devices when any non-empty Authorization header is provided; the code strips Bearer but does not validate or use the token in the DB query, allowing unauthenticated-like access to devic...

CVE-2026-49447 Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization heade...

CVE-2026-49258

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI /ui/ does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web...

CVE-2026-47726

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to...

CVE-2026-49258

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI /ui/ does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web...

CVE-2026-14869 terraform-mcp-server vulnerable to server side request forgery leading to token exposure

The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled...

CVE-2026-59933 PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE...

CVE-2026-54605

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumertokenrequest parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's...

CVE-2026-54619

sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version...