net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

EUVD-2026-66389

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside...

CVE-2026-52887-NocoBase-SQLi-RCE

CVE-2026-52887 — NocoBase SQL 삽입 → PostgreSQL 슈퍼유저 RCE NocoBase의 @nocobase/plugin-notification-in-app-message ≤ 2.0.60에 포함된 myInAppChannels:list 액션에서 SQL 삽입이 발생합니다. filterlatestMsgReceiveTimestamp$lt 요청 파라미터는 이스케이프나 바인딩 없이 원시 Sequelize.literal SQL 문자열에 직접 보간됩니다. PostgreSQL pg 드라이버의 스택드 스테이트먼트 지원을...

CVE-2026-57126 praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools.validateurl calls hostisblocked, which checks literal host encodings but does not resolve DNS names before scrapepage, crawl, extractlinks, extracttext, or URL-mention fetches connect. An attacker-controlled...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: arm64: probes: Removed the broken LDR literal uprobe support The simulateldrliteral and simulateldrswliteral functions are unsafe to use for uprobes. Both functions were originally designed for use with kprobes, and accessed...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-sqlparse (UTSA-2026-106767)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106767 advisory. sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQLREGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly...

EUVD-2026-62599

Orval: RCE via OpenAPI path - unescaped request-URL template literal backtick breakout...

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Summary Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL /users/... without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key functi...

GHSA-FG9P-MRXR-HVQ7 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Summary Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL /users/... without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key functi...

EUVD-2026-62658

Orval: RCE via servers.url - unescaped request-URL template literal with getBaseUrlFromSpecification...

GHSA-88F2-FPV8-89Q2 Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...

Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...

EUVD-2026-62657

Orval: Import-time RCE via schema default - zod module-level template literal...

GHSA-W727-8J6C-2RJ4 Orval: Import-time RCE via schema default -> zod module-level template literal

Summary Orval's zod schema generation emits a schema's default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported,...

Orval: Import-time RCE via schema default -> zod module-level template literal

Summary Orval's zod schema generation emits a schema's default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported,...

GHSA-2H9G-J24R-H63G Orval: Import-time RCE via array-items default -> zod module-level template literal

Summary Orval's zod schema generation emits the array-items default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

Orval: Import-time RCE via array-items default -> zod module-level template literal

Summary Orval's zod schema generation emits the array-items default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

EUVD-2026-62601

Orval: Import-time RCE via header-parameter default - zod module-level template literal...

Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Summary Orval's zod schema generation emits the header-parameter default value as a module-level template literal export const Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...