538 matches found
polaris
Polaris is an open source policy engine for Kubernetes Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration. It includes 30+ built in configuration policies, as well as the ability to build custom policies with JSON Schema. When run on the...
airflowscan
airflowscan Checklist and tools for increasing security of Apache Airflow. DISCLAIMER This project NOT AFFILIATED with the Apache Foundation and the Airflow project, and is not endorsed by them. Contents The purpose of this project is provide tools to increase security of Apache Airflow...
EUVD-2026-125806
IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is potentially vulnerable to denial of service due to uncontrolled regular expression complexity CWE-400 / ReDoS. An authenticated user with tool-registration privileges can embed catastrophically backtracking regex patterns in a tool's JSON Schem...
CVE-2026-94407
IBM ContextForge MCP Gateway versions v1.0.0 through v1.0.11 are vulnerable to a Regular Expression Denial of Service (ReDoS) (CWE-1333). The issue arises because the gateway validates tool arguments and results against JSON Schemas that may contain regular expression keywords like pattern or pat...
CVE-2026-34308
CVE-2026-34308: MySQL Server JSON component denial of service Official vendor bulletin: Oracle Critical Patch Update Advisory — April 2026. Summary from published CVE Vulnerability in Oracle MySQL Server component: Server: JSON. Supported affected versions: 8.0.0–8.0.45 , 8.4.0–8.4.8 , and...
Security Bulletin: IBM ContextForge MCP Gateway is affected by a regular expression denial of service
Summary IBM ContextForge MCP Gateway validates tool arguments, tool results and prompt arguments against JSON Schemas supplied by tool and prompt authors or by federated remote MCP servers, and these schemas can contain regular expression keywords such as "pattern" and "patternProperties". IBM...
PT-2026-147200
Name of the Vulnerable Software and Affected Versions IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 Description An issue exists where an authenticated user with tool-registration privileges can cause a denial of service. This occurs by embedding catastrophically backtracking regular...
CVE-2026-127208
datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by supplying a malicious JSON Schema with a crafted x-python-type annotation containing a string ast.Constant node in a subscript slice position, which bypasses...
CVE-2026-127208 datamodel-code-generator < 0.84.0 Code Injection via x-python-type Annotation
datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by supplying a malicious JSON Schema with a crafted x-python-type annotation containing a string ast.Constant node in a subscript slice position, which bypasses...
CVE-2026-127208
The datamodel-code-generator library (versions before 0.84.0 ) is vulnerable to a code injection vulnerability. The root cause is a validation bypass in parse_python_type_annotation and _python_type_expr_from_ast, which allows an attacker to provide a malicious JSON Schema with a crafted x-python...
EUVD-2026-124714
datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by supplying a malicious JSON Schema with a crafted x-python-type annotation containing a string ast.Constant node in a subscript slice position, which bypasses...
CVE-2026-127208 datamodel-code-generator < 0.84.0 Code Injection via x-python-type Annotation
datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by supplying a malicious JSON Schema with a crafted x-python-type annotation containing a string ast.Constant node in a subscript slice position, which bypasses...
CVE-2026-127208: datamodel-code-generator: datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve…
datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by supplying a malicious JSON Schema with a crafted x-python-type annotation containing a string ast.Constant node in a subscript slice position, which bypasses...
PT-2026-146058
datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by supplying a malicious JSON Schema with a crafted x-python-type annotation containing a string ast.Constant node in a subscript slice position, which bypasses...
Security Bulletin: Vulnerabilities in spring-context, logback-core and Another JSON Schema Validator might affect IBM Storage Defender Copy Data Management
Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in spring-context, logback-core and Another JSON Schema Validator. Vulnerabilities include VMware Tanzu Spring Framework could provide weaker than expected security, caused by a flaw related to disallowedFields...
CVE-2026-123845
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects...
CVE-2026-123846
In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation...
CVE-2026-123846
In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation...
CVE-2026-123846
In JetBrains IntelliJ IDEA versions prior to 2026.3 , a blind SSRF (Server-Side Request Forgery) vulnerability exists. The flaw is triggered via remote references during JSON Schema validation . The impact is categorized as a low-severity confidentiality risk requiring user interaction. Remediati...