254 matches found
GHSA-RJ39-CV6W-8WV7 kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
Summary kin-openapi guards against NaN and Inf values in its built-in schema visitor visitJSON by returning ErrSchemaInputNaN / ErrSchemaInputInf when a float64 input violates those constraints. For OAS 3.1 specs, however, Schema.VisitJSON routes through useJSONSchema2020, which hands the value...
kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
Summary kin-openapi guards against NaN and Inf values in its built-in schema visitor visitJSON by returning ErrSchemaInputNaN / ErrSchemaInputInf when a float64 input violates those constraints. For OAS 3.1 specs, however, Schema.VisitJSON routes through useJSONSchema2020, which hands the value...
CVE-2026-100352
The kin-openapi Go project (prior to version 0.148.0 ) is vulnerable to a denial-of-service condition during OpenAPI 3.1 validation . The root cause is that the validation path passes YAML NaN and infinity numeric values (.nan, .inf, -.inf) to the santhosh-tekuri/jsonschema v6.0.2 dependency with...
CVE-2026-100352 kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an...
CVE-2026-100352 kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an...
CVE-2026-100352 kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an...
@akbarsafari00/bonyan (>=5.52.1-fa.2, <=5.52.1-fa.6), @akbarsafari00/bonyan-core (>=5.52.1-fa.5, <=5.52.1-fa.6) +88 more potentially affected by CVE-2026-85024 via undici (>=6.25.0, <=6.28.0)
undici NPM version =6.25.0, =5.52.1-fa.2, =5.52.1-fa.5, =0.1.0-rc.27, =0.1.0-rc.27, =1.3.0, =1.3.0, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =2.7.4, =0.4.38, =1.3.1 and more Source cves: CVE-2026-85024 Source advisory: OSV:GHSA-3WWX-PV8P-Q78V...
@akbarsafari00/bonyan (>=5.52.1-fa.2, <=5.52.1-fa.6), @akbarsafari00/bonyan-core (>=5.52.1-fa.5, <=5.52.1-fa.6) +88 more potentially affected by CVE-2026-85024 via undici (>=6.25.0, <=6.28.0)
undici NPM version =6.25.0, =5.52.1-fa.2, =5.52.1-fa.5, =0.1.0-rc.27, =0.1.0-rc.27, =1.3.0, =1.3.0, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =2.7.4, =0.4.38, =1.3.1 and more Source cves: CVE-2026-85024 Source advisory: GHSA-3WWX-PV8P-Q78V...
Malicious code in f0-service-oas (npm)
The package communicates with a domain associated with malicious activity. --- Credit: OpenSSF source...
Open Automation Software OAS Platform V16.00.0121 - Missing Authentication Detection
An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...
CVE-2026-5650
A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function of the file /enrollment/database/oas.sql. Performing a manipulation results in insecure storage of sensitive information. The attack is possible to be carried out remotely. The...
CVE-2026-5650 code-projects Online Application System for Admission oas.sql sensitive information
A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function of the file /enrollment/database/oas.sql. Performing a manipulation results in insecure storage of sensitive information. The attack is possible to be carried out remotely. The...
CVE-2026-5650
The CVE-2026-5650 entry concerns code-projects Online Application System for Admission 1.0. A vulnerability affects an unknown function within the file /enrollment/database/oas.sql, enabling manipulation that leads to insecure storage of sensitive information. The attack is described as remotely ...
CVE-2023-31242
An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially-crafted series of network requests can lead to arbitrary authentication. An attacker can send a sequence of requests to trigger this vulnerability...
CVE-2022-26026
A denial of service vulnerability exists in the OAS Engine SecureConfigValues functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted network request can lead to loss of communications. An attacker can send a network request to trigger this vulnerability...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The package was flagged as malicious during the Sha1-hulud supply chain attack. Although the Sha1-hulud IoCs are not present within the package, the contents of the affected version were removed from the officia...
Malware in @medusajs/medusa-oas-cli
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
MAL-2025-191458 Malicious code in @medusajs/medusa-oas-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48124e119c7f2c21e744172a5901266335824c5ceac7a1c631805772baa3798a The package @medusajs/medusa-oas-cli was found to contain malicious code. Source: ghsa-malware...
