6638 matches found
MINI-FG3P-MHHJ-HR64
Bulletin has no description...
MINI-MHGJ-XRR3-MXH2
Bulletin has no description...
EUVD-2026-50129
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...
ECHO-D2AD-9332-96C9
Bulletin has no description...
CVE-2026-55390
datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodelcodegenerator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside...
Directory Traversal
Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Directory Traversal via the schemaLocation attribute in XSD processing. An attacker can access arbitrary files on the local filesystem by supplying a crafted XML Schema file that us...
EUVD-2026-50068
datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodelcodegenerator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside...
CVE-2026-55390
The CVE affects datamodel-code-generator where XML Schema parsing (src/datamodel_code_generator/parser/xmlschema.py) for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside the input base path, allowing arbitrary local files to be...
CVE-2026-48390
creationtimestamp| type| source ---|---|--- 2026-07-28 18:51:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrq3du7bp62q 2026-08-06 18:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msgoqfwnpd2y 2026-08-28 12:53:36+00:00| seen|...
CVE-2026-54605
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumertokenrequest parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's...
OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host
Summary When an application uses OAuth2::Client typically via an OAuth2::AccessToken and the configured authorization server returns a redirect whose Location header is a protocol-relative URI of the form //attacker.example/leak, OAuth2::Clientrequest resolves the redirect with...
MINI-82X5-RXVX-CFG4
Bulletin has no description...
MINI-733X-PXQF-28MF
Bulletin has no description...
MINI-PF74-MHGF-2XP4
Bulletin has no description...
CVE-2026-65921
A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...
MINI-H53V-6P5M-H43M
Bulletin has no description...
MINI-R362-XW5G-RGHJ
Bulletin has no description...
MINI-3JH6-C638-WHFX
Bulletin has no description...
CVE-2026-65921 Potential path traversal leading to unauthorized file writes
A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...