19019 matches found
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal through the OpenApiDocumentDownloadService and KiotaBuilder document-loading path. An attacker can trigger SSRF, remote file inclusion, and local file inclusion by supplying a spec whose $ref points to an...
CVE-2026-63086
text-generation-inference through 3.3.7 contains a server-side request forgery SSRF vulnerability in the OpenAI-compatible multimodal chat completions endpoint that allows unauthenticated network attackers to coerce the server into issuing arbitrary HTTP GET requests by supplying a crafted imageu...
CVE-2026-63086
The CVE-2026-63086 entry concerns text-generation-inference 3.3.7, with an SSRF flaw in the OpenAI-compatible multimodal chat completions endpoint. The fetch_image function in router/src/validation.rs does not validate addresses (private, loopback, link-local, or cloud metadata). The HTTP client ...
CVE-2026-59863 Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious...
Windows Admin Center Spoofing Vulnerability
Improper neutralization of input during web page generation 'cross-site scripting' in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network...
ROS-20260716-73-0041
The vulnerability in Vim is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the Vim text editor, related to improper handling of code generation, allows a hacker to execute arbitrary code.
The vulnerability of the Vim text editor is related to improper handling of code generation. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
PT-2026-60451
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified AWS Cognito affected versions not specified Microsoft Entra ID affected versions not specified Description One issue exists in the Linux kernel where the ECSPI is incorrectly configured when a DMA...
CVE-2026-9007 Reflected XSS in HCL Notes
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in HCL Notes from HCL Software allows reflected Cross-Site Scripting XSS. Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of another user. This issue affects...
SUSE-SU-2026:3040-1 Security update for python-cryptography
This update for python-cryptography fixes the following issues: - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270208. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length...
CVE-2026-61433 PraisonAI before 4.6.78 Code Injection via API deployment generator
PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agentsfile configuration parameters that execute when the generated server starts or...
Exploit for CVE-2026-55511
CVE-2026-55511 PoC Non-weaponized proof of concept for a Yamc...
The vulnerability of the control consoles for SonicWall SMA 1000 microprogrammed network interface devices allows attackers to execute arbitrary code.
The vulnerability of the control consoles for SonicWall’s SMA 1000 microprogrammed network interface devices is related to improper code generation. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...
The vulnerability affects the implementation of the WebRTC technology in Mozilla Firefox ESR and Thunderbird email client, allowing a hacker to execute arbitrary code.
The vulnerability in the implementation of the WebRTC technology in Mozilla Firefox ESR and the Thunderbird email client is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-50650
Improper control of generation of code 'code injection' in .NET Framework allows an unauthorized attacker to elevate privileges locally...
CVE-2026-24226
NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...
CVE-2026-24226
NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...
CVE-2026-48784 Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate used strtr dot-segment encoding that skipped every other chained ../ or ./ segment, allowing attacker-controlled route parameters...
