MINI-FG3P-MHHJ-HR64

Bulletin has no description...

MINI-MHGJ-XRR3-MXH2

Bulletin has no description...

EUVD-2026-50129

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...

ECHO-D2AD-9332-96C9

Bulletin has no description...

CVE-2026-55390

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodelcodegenerator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside...

Directory Traversal

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Directory Traversal via the schemaLocation attribute in XSD processing. An attacker can access arbitrary files on the local filesystem by supplying a crafted XML Schema file that us...

EUVD-2026-50068

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodelcodegenerator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside...

CVE-2026-55390

The CVE affects datamodel-code-generator where XML Schema parsing (src/datamodel_code_generator/parser/xmlschema.py) for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside the input base path, allowing arbitrary local files to be...

CVE-2026-48390

creationtimestamp| type| source ---|---|--- 2026-07-28 18:51:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrq3du7bp62q 2026-08-06 18:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msgoqfwnpd2y 2026-08-28 12:53:36+00:00| seen|...

CVE-2026-54605

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumertokenrequest parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's...

OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host

Summary When an application uses OAuth2::Client typically via an OAuth2::AccessToken and the configured authorization server returns a redirect whose Location header is a protocol-relative URI of the form //attacker.example/leak, OAuth2::Clientrequest resolves the redirect with...

MINI-82X5-RXVX-CFG4

Bulletin has no description...

MINI-733X-PXQF-28MF

Bulletin has no description...

MINI-PF74-MHGF-2XP4

Bulletin has no description...

CVE-2026-54605: Exposure of Sensitive Information to an Unauthorized Actor

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumertokenrequest parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's...

CVE-2026-65921

A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...

MINI-H53V-6P5M-H43M

Bulletin has no description...

MINI-R362-XW5G-RGHJ

Bulletin has no description...

MINI-3JH6-C638-WHFX

Bulletin has no description...

CVE-2026-65921 Potential path traversal leading to unauthorized file writes

A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...