PT-2026-97411

Name of the Vulnerable Software and Affected Versions @orval/core versions prior to 8.28.0 Description A code injection issue exists in the form-data serializer. The component fails to escape multipart property names within generated template literals. This allows attackers to inject $...

CVE-2026-96758: Improper Control of Generation of Code

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in form-data 4.0.5

Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include open-source package axios which transitively depends on package form-data, which is affected by a high severity vulnerability. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in form-data (CVE-2026-12143)

Summary An HTTP header injection vulnerability in the form-data multipart stream creation library CVE-2026-12143 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 4.0.6. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a libra...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in python-multipart (CVE-2026-24486, CVE-2026-40347, CVE-2026-42561, CVE-2026-53540)

Summary Multiple vulnerabilities in the python-multipart streaming parser library CVE-2026-24486, CVE-2026-40347, CVE-2026-42561, CVE-2026-53540 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 0.0.32. Vulnerability Details CVEID:CVE-2026-40347...

TencentOS Server 2: python-tornado (TSSA-2026:1040)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1040 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

Security Bulletin: Vulnerability in form-data affects DB2 Dev Extension (CVE-2026-12143)

Summary Upgraded form-data to 4.0.6 to remediate CVE-2026-12143 CWE-93: CRLF Injection — CVSS Base Score 7.5 High — PVR0791412. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field...

CVE-2026-92567

TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify...

CVE-2026-92567 TDuck survey form through 5.0 Unauthorized Data Modification

TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify...

CVE-2026-92567 TDuck survey form through 5.0 Unauthorized Data Modification

TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify...

EUVD-2026-80813

TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify...

CVE-2026-92567 TDuck survey form through 5.0 Unauthorized Data Modification

TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify...

CVE-2026-92567: Authorization Bypass Through User-Controlled Key

TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in form-data-3.0.4.tgz

Summary IBM Watson Discovery Cartridge affected by vulnerability in form-data-3.0.4.tgz Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field argument to FormDataappend and the filenam...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in multer

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in multer Vulnerability Details CVEID:CVE-2026-5038 DESCRIPTION: Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malform...

DEBIAN-CVE-2026-91990

Tornado before 6.5.8 contains a memory amplification vulnerability in parsemultipartformdata that splits multipart data before validating the maxparts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial ...

Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem

Summary Multiple vulnerabilities were addressed in IBM watsonx Code Assistant On Prem V5.3.1 Patch 12 Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field argument to FormDataappend a...

PT-2026-92104

Tornado before 6.5.8 contains a memory amplification vulnerability in parse multipart form data that splits multipart data before validating the max parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing...

EUVD-2026-77679

Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An...

Astra Linux – Vulnerability in node-form-data

The use of insufficiently random values in form-data allows for HTTP Parameter Pollution HPP. This vulnerability is associated with the program file lib/formdata.Js. This issue affects form-data versions: 2.5.4, 3.0.0 – 3.0.3, 4.0.0 – 4.0.3...